Security

Lenders trust Vurno with their past clients: names, addresses, loan details and the conversations that follow. This page explains how we protect that information, written for the compliance and IT teams who ask. Our Privacy Policy covers what we collect and why; the subprocessor list names every company that handles it for us.

Where your data lives

• The app runs on Vercel in Cleveland, Ohio. The database and uploaded files are on Neon, in Amazon Web Services’ Ohio region. Everything stays in the United States.
• Every connection is encrypted: the site and app are HTTPS only, with HTTP Strict Transport Security, and the app reaches the database over TLS.
• The database and file storage are encrypted at rest by our provider. Credentials for the systems you connect, such as a CRM token or a webhook secret, are encrypted again by Vurno with AES-256-GCM before they are stored.

Keeping workspaces apart

Each customer’s workspace is separated by the database itself, not only by the app’s code. Every table carries row-level security: each query the app makes is limited by the database to one workspace, so a bug in a page can’t show another lender’s clients. The nightly work that spans workspaces runs under a separate login, and sign-in has its own login that can’t read client data at all. Automated tests check that separation.

Signing in

• Passwords must be at least 12 characters and are checked against known data breaches (only the first characters of a scrambled copy leave our servers, never the password). They are stored as a one-way hash that we can’t read.
• New accounts confirm their email before they get in. Repeated sign-in attempts are refused for a while.
• Two-step sign-in with an authenticator app or a passkey, and a workspace can require it of everyone.
• Single sign-on through your identity provider (SAML or OpenID Connect: Okta, Microsoft Entra ID, Google Workspace and others), for the email domains you verify, and SCIM to add and remove people automatically.
• Removing someone, or deactivating them in your identity provider, signs them out on every device at once.

Who can see and do what

• Roles for owners, admins, managers, loan officers, assistants and billing contacts. A workspace can show each loan officer only their own clients; the database enforces that too.
• An activity log records sign-ins, exports, role changes, invitations and removals, single sign-on and provisioning changes, and connected integrations. Owners and admins can filter it and download it.
• Exports can be limited to owners and admins, and every download is recorded.

Vurno staff access

Only a short list of Vurno staff can open the operator console, and only after a second sign-in step. When support needs to see a workspace to help, the view is read-only, expires on its own, and is recorded in our operator log and in that workspace’s activity log.

The app itself

• A strict Content Security Policy: scripts run only when the page that served them allows them, per request.
• Links in our emails and homeowner pages are signed, so they can’t be altered to reach someone else’s page.
• Webhooks you point Vurno at can only reach public internet addresses, never our own network.
• Every change is type-checked, tested and built automatically, and our dependencies are checked for known vulnerabilities each time.
• Errors and request logs are kept 30 days for investigation, and an outside monitor checks the app every few minutes. Current health is on our status page.

Backups

The database can be restored to any moment in the last 7 days. Daily snapshots are kept 14 days and weekly snapshots 35 days.

Your data, your call

• Download everything at any time from Settings: clients, agents, notes, to-dos, value history, messages and activity, as spreadsheets.
• An owner can close the workspace. It can be reopened, or exported, for 90 days; after that it is deleted, uploads included. Backup copies roll off within 35 days after that.
• Homeowners can unsubscribe from any email and reply STOP to any text.

Compliance

Many of our customers are financial institutions under the Gramm-Leach-Bliley Act; we act as their service provider and protect the information they entrust to us accordingly. Vurno does not have a SOC 2 report yet. If your team has a security questionnaire or needs a data processing addendum, write to support@vurno.io and we’ll work through it with you.

Reporting a vulnerability

If you believe you’ve found a security problem in Vurno, write to support@vurno.io with the details. Please give us a chance to fix it before you share it, don’t access or change data that isn’t yours, and don’t disrupt the service while you test. We’ll acknowledge your report and keep you posted on the fix. Our security.txt has the same contact.