Security at Vi: what we protect, and how
Your source code never leaves your machine. Your workspace data is isolated, sent only over HTTPS, and backed up every night — and we test that the backups actually restore.
Your source code never leaves your machine
Git runs on the developer's computer, through the IDE extension. Vi never reads, stores, or uploads your source code. When a task is finished with Commit & Close, Vi receives only the commit's details — hash, message, branch, line counts, and the names of the changed files — so reviewers can see which files a task touched.
Each workspace is isolated
Every record belongs to one workspace, and every request is checked on the server against that workspace and the user's role — not only in the browser. One company never sees another company's data.
Roles decide who can do what
Workspace roles (Owner, Admin, Member), team roles, and approval steps in your workflow control who can see, change, approve, or delete work. Customers who send requests get their own limited role and see only their own requests.
Customers see status, not your internals
The status link Vi sends to a customer shows the request's progress only — no staff names and no internal comments. It stops working 7 days after the request is closed, and you can revoke it at any time. Customers sign in to their panel with a one-time link sent by email.
Sign-in and sessions
All traffic uses HTTPS. Access tokens are signed (ES256) and expire after 30 minutes; refresh tokens rotate on every use, and you can sign out of all sessions at once. Session and sign-in link tokens are stored only as hashes. New accounts confirm their email address. Passwords are stored as salted PBKDF2-SHA256 hashes. After 5 failed sign-ins for one email (or 30 from one IP) within 15 minutes, sign-in is locked for 15 minutes; password-reset and sign-in-link requests are rate-limited the same way.
Encrypted backups every night
Every night the database, attachments, and server configuration are backed up. Backups are encrypted on our server before they leave it, and stored in Google Cloud Storage, separate from the production server. We keep 7 daily, 4 weekly, and 12 monthly copies, and deleted backup files stay recoverable for 30 days — so even someone who took over the server could not quietly erase them.
We test that backups restore
A backup you have never restored is only a hope. Once a month, an automated job restores the latest backup into a separate database, compares it with the live data (tables, workspaces, tasks, and files), and alerts us if anything does not match.
Activity logs
Important actions — creating, assigning, moving, approving, rejecting, reopening, and deleting tasks, plus comments — are logged with who did it and when, so your team can see what changed.
Payments go through Paddle
Paddle is our Merchant of Record and handles checkout, invoices, and tax. Vi never sees or stores card numbers; we receive only your plan and subscription status.
AI features send only what you submit
AI features are optional and run only when you click them. Only the text you submit is sent to the AI provider — never source code, attachments, or other tasks.
Found a vulnerability?
Please report it privately to support@useviapp.com. We read every report, reply, and fix confirmed issues as a priority.
Start with a workspace that is backed up from day one
Start free in two minutes. No credit card required.
Get Started Free