Security & privacy at Vitrily.

Vitrily is published by AGENSIO AI, whose stack passed a CASA Tier 2 security audit in April 2026, performed by TAC Security, with a score of 9.1/10. CASA (Cloud Application Security Assessment) is the framework Google requires for apps handling sensitive user data, and Tier 2 is the level applied to established SaaS platforms.

The audit covered secure development lifecycle, OWASP Top 10 mitigations, penetration testing, code review, dependency scanning, incident response, and data-classification policies. Every Vitrily deployment inherits the same posture: same Content Security Policy, same OAuth chain, same Sentry-monitored error surface, same review process before shipping to production.

• TAC Security audit · April 2026, score 9.1/10, CASA Tier 2 framework.
• OWASP Top 10 coverage · SQLi, XSS, CSRF, SSRF, IDOR, SSPP all reviewed and mitigated.
• Continuous dependency scanning · npm audit + Vercel security advisories on every deploy.

Every byte of customer data (accounts, sites, bookings, media, analytics) lives on Supabase Postgres in Frankfurt, Germany. The Vitrily application itself runs on Vercel's European edge, and email is dispatched through Resend's EU region. There is no US-region fallback, no CDN caching of personal data outside the EU, and no third-party analytics that ships behavior data across the Atlantic.

Vitrily terminates TLS 1.3 on every connection, with HSTS enforced across the board. Passwords are hashed with Argon2id (memory-hard, resistant to GPU brute-force). Session cookies are HMAC-signed with a rotating server secret. Database secrets, OAuth tokens, and Stripe keys are stored as encrypted environment variables in Vercel, never checked into code, and rotated on a scheduled cadence.

• TLS 1.3 · every request, HSTS 1 year, preload eligible.
• Argon2id password hashing · memory-hard, resistant to GPU brute-force.
• HMAC-signed session cookies · HttpOnly, Secure, SameSite=Lax by default.
• Secrets rotation · Vercel encrypted env vars, rotated on suspected compromise.

Every layer is hardened, so a single mistake never becomes a breach. These controls ship with every Vitrily account, no configuration required.

• Strict Content Security Policy · no inline scripts allowed on user-facing pages, allowlisted CDNs only.
• CSRF protection · every state-changing request signed with a per-session token.
• Distributed rate limiting · login, signup, and API endpoints throttled by IP and by user.
• IP hashing for analytics · no raw IPs stored, only truncated one-way hashes, no cookies dropped.
• Sentry error monitoring · every incident traced, alerted, and reviewed within 24 hours.
• Uploads virus-scanned · every image or media file passes a signature check before landing in your site.