Security

    This page describes the security measures actually in place on Vantrel today. Where Vantrel has not completed a formal third-party audit or certification, that is stated directly rather than implied.

    Account and sign-in security

    • Authentication is handled through Supabase Auth using the PKCE flow, the current standard for browser-based OAuth and email sign-in.
    • Multi-factor authentication (TOTP) is available and can be enrolled from account settings.
    • Passkey sign-in is supported as a phishing-resistant alternative to passwords.

    Data access controls

    Every table that stores candidate data is protected by row-level security (RLS) policies enforced directly by the database. A candidate's own session history, answers, and progress are scoped to that candidate's account at the database level, not only at the application layer.

    Payments

    Payments are processed by Flutterwave. Vantrel does not receive or store full card numbers.

    Bot and abuse protection

    Sign-in, sign-up, and contact forms are protected by Cloudflare Turnstile to reduce automated abuse.

    Monitoring

    Application errors are tracked through Sentry so issues can be identified and addressed without relying only on user reports.

    What Vantrel has not yet done

    Vantrel has not completed a formal third-party security certification, such as SOC 2 or ISO 27001, or a penetration test at this time. This page will be updated if that changes.

    Reporting a security issue

    If you believe you have found a security issue, contact us with details of what you found.

    Contact support