How we handle your data.
Companion to the privacy policy. Where the policy answers what we collect and why, this page answers how it's protected, where it lives, who else touches it, and how you stay in control. Updated as the product changes.
- Records residency
- Canada
- Processing
- United States
- Transport
- TLS 1.2+
- Sub-processors
- 7
Encrypted both ways.
- In transit
- Everything is HTTPS end-to-end. HTTP is redirected. Certificates are Let's Encrypt via Vercel; renewal is automated.
- At rest
- Supabase (Postgres + auth) encrypts at rest with AES-256. Vercel Blob objects are encrypted at rest by the underlying store. Environment variables (Stripe keys, Supabase service role, MakeSplat token) are encrypted on Vercel and only decrypted at function invocation.
- Passwords
- Hashed by Supabase using bcrypt at cost factor 10. We require at least 12 characters with upper and lower case, a number and a symbol, and every new password is checked against the haveibeenpwned breach corpus by k-anonymity — only the first five characters of its SHA-1 hash ever leave your browser. We never see cleartext passwords.
- Card data
- Handled entirely by Stripe. We store a Stripe customer id and a subscription status; we never see card numbers, CVCs, or billing addresses.
Scoped at the database, not the UI.
- Row-level security on every table
- Every query — from our Node code, a Supabase browser client, or a direct REST call — is filtered through Postgres RLS policies. Workspace A cannot see Workspace B's tours, leads, or notifications even at the database level.
- Role-based UI + API gates
- Team-plan workspaces have four roles: owner / admin / agent / viewer. Enforced at both the RLS layer and the API-route layer so a compromised client can't bypass by direct request.
- Service-role usage
- The Supabase service-role key bypasses RLS. We only use it in server-only code paths for legitimate cross-workspace reads (public tour URL resolution, Stripe webhook mutation). Never exposed to the browser.
- Cron endpoints
- /api/cron/* is authenticated via CRON_SECRET on the Authorization header. No fallback — cron is refused if the secret is not set or doesn't match. Query-string secrets are not accepted (they would leak in access logs).
Canada for records, US for processing.
- Primary Postgres
- Supabase, region ca-central-1 (Canada). All profile, tour, lead, event, and workspace data.
- Video + reconstructed files
- Raw walkthrough videos live on Vercel Blob (US multi-region) until 60 days after successful reconstruction, then are automatically deleted. Reconstructed .ply files stay on Vercel Blob while a subscription is active, plus 90 days after lapse.
- Reconstruction processing
- MakeSplat (US). Your video is transmitted to their infrastructure via a presigned Cloudflare R2 upload URL, processed (typically under an hour — a target, not a guarantee), and returned as a .ply. MakeSplat holds the source until you request deletion or 30 days pass, whichever is first.
- Payments
- Stripe (US). Only the Stripe customer id and subscription state are mirrored to our database; no card material.
Monitored, backed up, honestly labelled.
- Monitoring
- Every runtime error is captured to Sentry with source maps. Scheduled dependency checks are recorded and published at /status. Cron failures surface in Sentry too — not silently swallowed.
- Backups
- Supabase Pro handles daily automated backups with 7-day retention. We take a weekly logical dump to a separate storage account as belt-and-suspenders.
- Compliance status
- Not SOC 2 certified yet — early-stage single-founder company. We treat every user like a GDPR user by default, regardless of jurisdiction: consent controls, portability, deletion. Custom-tier customers can request our current SOC 2-readiness posture and the DPA template.
Your data. Your rules.
Fewer cookies, plain-language legal, and the ability to walk away with everything you paid us to make — at any time. If we don't need it, we don't collect it.
Right to portability
Download every tour as a .ply file at any time — no export button hidden behind a plan, no proprietary lock-in. If you leave, you leave with your data.
Right to be forgotten
Delete your account and every associated tour, lead and analytics event is permanently removed within 30 days. Audit logs are kept 12 months for security review, then purged too.
Cookie + tracker transparency
Essential cookies for auth, Vercel Analytics for page views, Sentry for errors. No ad-tech, no marketing pixels, no third-party trackers. Every non-essential category can be toggled at any time.
Audit trail
Every workspace-level action — invite, role change, tour publish, tour delete — is logged. Owners can request a full export of the last 12 months of activity.
Portability has a key, not just a button.
Every workspace mints its own keys under Settings → API keys. They are workspace-scoped and revocable at any time, and the same screen carries a request/response reference and the webhook delivery log. Full reference: /developer/api.
Every third party that touches your data.
The vendors VOLUME runs on. If we add or remove one, this list and the legal sub-processor notice are updated and subscribed customers are notified 30 days in advance.
- VercelEdge network, serverless functions, Blob storageUSA / global
- SupabasePostgres, auth, storageCanada (AWS ca-central-1)
- MakeSplatGaussian-splat reconstructionUSA
- CloudflareR2 upload staging for reconstructionGlobal
- StripePayments + subscription billingUSA / Ireland
- SentryError + performance telemetryUSA
- ResendTransactional email deliveryUSA / EU
Find a bug? Tell us first.
Email security@volumevirtual.com with a reproduction, expected vs actual, and a proof-of-concept if relevant. We reply within three business days. No bounty program yet — reporters are credited here and in the changelog, with permission.
Machine-readable version: /.well-known/security.txt. Other questions: hello@volumevirtual.com.
Need a DPA or a security questionnaire?
If you're procuring VOLUME for a team, we'll send the DPA template and walk through your questionnaire on a call.