VortopsSecurity
Vortops is run by one person, so this page sticks to what is actually in place and avoids claims we cannot back up.
What we do
- Encrypted connections. The site and the API are served over HTTPS.
- No passwords to steal. You sign in with a one-time email link that expires.
- Hashed keys. Site keys are stored only as hashes, so we cannot read them back and a database leak does not expose working keys. Each connected site has its own key that you can replace or revoke.
- No card data. Card details go straight to Stripe and never reach our systems.
- Limits. Requests are rate limited per site and per account, and accounts can have spend limits, to contain misuse and mistakes.
- Minimal content storage. By default, prompts, uploads and results are not stored after a request completes.
- Least access. Production credentials are kept out of source code, and access is limited to what is needed.
What we do not claim
Vortops does not hold a formal security certification such as SOC 2 or ISO 27001. If that changes we will say so here.
Report a problem
If you think you have found a security issue, tell us through the contact page with "Security" at the start of your message and enough detail to reproduce it. Please do not access other people's data, disrupt the service or publish details before we have had a reasonable chance to fix it. We will acknowledge your report and keep you updated. We do not run a paid bounty programme.