Security
Your models' sales, content and contracts go through Velora. Here's how we protect them, point by point. Only concrete measures, already live.
Security measures
Every agency isolated
Every record carries its agency's ID. The filter is applied twice: in the code and in PostgreSQL (Row Level Security).
Automated tests check on every route that one agency never reads another's data.
One encryption key per agency
Your integration keys and your models' sessions are encrypted with AES-256-GCM, using a key unique to your agency.
That key is itself encrypted by a master key kept outside the database. A key is never shown in full again.
Double-locked sign-in
Passwords hashed with Argon2id. 2FA required for owners and admins. Passkeys accepted.
Rotated sessions, progressive lockout after failures, alert on every new device, remote sign-out.
Private media
No photo or video has a public address. Every link is signed and expires in 5 minutes.
Previews carry an invisible watermark unique to each model. A leak can be traced.
Anti-scraping
Rate limits per IP, per account and per agency. A suspicious burst is blocked and flagged.
50 items max per page, Cloudflare Turnstile on sign-up and sign-in. No response reveals whether an email exists.
Zero trackers
No third-party script runs, except Stripe for payments and Turnstile against bots.
HSTS, __Host- cookies with SameSite, origin checked on every request, COOP and CORP headers.
Audit log
Invites, roles, keys, exports, deletions: everything is logged, with who and when.
The log can't be edited. Your team reads it in settings.
Locked-down iPhone app
Apple App Attest: only the real app can talk to the API. Sessions stored in the iOS keychain.
Screen blurred in the background, allowed domains only, API certificate pinned.
GDPR
Data export and deletion from the console. A data processing agreement (DPA) signed with every agency.
Encrypted backups every day. Models' data belongs to their agency.
What we'll never do
Commitments written into our terms.
Sell or rent your data, or your models' data.
Put an ad tracker on the site, the console or the app.
Look at your models' content. Our team has no access, unless you ask in writing to fix an outage.
Contact your models to offer them something else.
Found a vulnerability?
Email support@velora-hq.com. We reply within 48 business hours and keep you posted on the fix.
Your app can be ready this afternoon.
Create your account, set your colors, invite your first model.