Security at Vesta Plus

Sensitive personal information — including breach-incident details, affected-individual descriptions, internal notes, and privacy-officer contact information — is encrypted at rest using AES-256-GCM, an authenticated encryption standard. All traffic to and from the application is protected in transit with TLS (HTTPS).

Accounts are protected by a modern authentication system with mandatory email verification and optional Google or Microsoft single sign-on. Passwords are salted and hashed, never stored in plain text. Every request is authorized against the signed-in account, so your data stays isolated from other organizations.

Billing is handled entirely by Stripe, a PCI-DSS Level 1 certified provider. Vesta Plus never sees or stores your full card number.

You stay in control of your information, in line with Quebec's Law 25:

• →Export a complete copy of your data at any time (data portability).
• →Permanently delete your account and all associated data (right to erasure).
• →Manage your marketing-communication consent from your settings.

Vesta Plus runs on managed, enterprise-grade infrastructure (Vercel and Neon) with encryption at rest and automated backups. Our infrastructure providers maintain SOC 2 Type II compliance. Application secrets are kept out of source code and injected only at runtime.

The application ships with strict HTTP security headers (HSTS, Content-Security-Policy, and clickjacking protection), rate limiting on sensitive endpoints, and audit logging of administrative and data-export actions.