> ## Documentation Index > Fetch the complete documentation index at: https://vlyai-1c28d863.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Security > How vly secures your data, secrets, and accounts. Encryption, access control, isolation, audit logs, compliance — and what you can do on your side. Security at vly works at three layers: the **platform** (vly's infrastructure), the **runtime** (how your app handles data), and the **practice** (the workflows your team follows). This page is the executive overview; the rest of this section deep-dives each topic. ## What vly does for you All data in Convex's managed database is encrypted at rest with AES-256. All API and admin traffic uses TLS 1.3. API keys and other secrets live in vly's secrets store, scoped per environment, never exposed to client code. See [Secrets management](/security/secrets-management). Each workspace's data is logically isolated. The Convex query layer prevents cross-tenant reads. Every meaningful action — sign-in, settings change, API call — is logged. Available for export. Edge-level rate limiting and DDoS mitigation on every vly-served endpoint. Convex maintains continuous backups; point-in-time restore available on Business+ tiers. ## What your app should do The platform handles infrastructure security. Application-level security — input validation, access control, secrets handling in your custom code — is yours. Convex schema validators catch most bad data; for business rules, validate inside mutations. Use `ctx.auth.getUserIdentity()` and filter on the user's workspace / team. The default vly-generated code does this; preserve it. Anything in `process.env` is server-only. Anything starting with `VITE_` is client-visible — only public keys belong there. Login attempts, sign-up, password reset, API endpoints exposed to the public — all need rate limits. React handles most XSS by default. For raw HTML or user-generated markdown, use a sanitizer. CSRF is handled by built-in auth. Beyond vly's platform audit log, your app should log domain-meaningful actions (sent invoice, deleted account, ran agent on production). ## Threat model The threats vly's platform defends against: | Threat | How it's mitigated | | - | - | | Unauthorized access to your data | Workspace-scoped auth; per-tenant isolation; encryption at rest | | Stolen API key abuse | Rate limiting per key; instant revocation; audit log | | DDoS / brute-force | Edge rate limiting; Convex's built-in attack mitigation | | Data loss | Continuous Convex backups; multi-region replication | | Supply chain (malicious npm package) | Locked dependencies; vly reviews dependency updates before they ship | | Insider risk | Access logs for vly staff; SOC 2 controls (in progress) | | Code injection | TypeScript + Convex schema validation; default React XSS protections | For application-level threats (XSS, CSRF, SQLi-equivalent in Convex, IDOR), see the linked deep-dives below. ## Compliance Customer data export and deletion supported via [Data export](/security/data-export) and [Account deletion](/security/account-deletion). DPA available on request. Audit in progress; report available to Enterprise customers. Email [security@vly.ai](mailto:security@vly.ai) for status. Not currently supported. If you need HIPAA, contact [enterprise@vly.ai](mailto:enterprise@vly.ai) about timing. Roadmap. ## Reporting a security issue If you've found a security vulnerability: 1. **Do not** file a public issue or post on social media. 2. Email [security@vly.ai](mailto:security@vly.ai) with details. 3. We'll acknowledge within 24 hours and work with you on disclosure timing. We follow [coordinated disclosure](https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure). Researchers acting in good faith are eligible for our [bug bounty program](mailto:security@vly.ai) — email for details. ## Security checklist for production apps Before launching a vly app to real users: * [ ] All third-party API keys live in vly's secrets store (not in code, not in `VITE_*`). * [ ] All Convex queries scope by `ctx.auth.getUserIdentity()`. * [ ] All Convex mutations validate input via the schema validators (`v.string()`, `v.number()`, etc.). * [ ] User input rendered as raw HTML is sanitized (use [DOMPurify](https://github.com/cure53/DOMPurify) or similar). * [ ] Login, signup, and password-reset endpoints are rate-limited. * [ ] Account deletion is tested end-to-end. * [ ] Webhook handlers verify signatures (Stripe, Resend, etc. — every integration that pushes events). * [ ] Audit log is reviewed before launch (no surprising actions). * [ ] DNS for the custom domain has a current SPF / DKIM / DMARC config (for email deliverability and anti-spoofing). * [ ] Privacy policy and terms of service are linked from the app. ## Deep dives Patterns for sign-up, password reset, MFA, session management. The secrets store: encryption, scoping, rotation, audit. Schema validators, business rule validation, sanitization. Per-user, per-workspace, per-team scoping patterns. React defaults, edge cases, when to sanitize, CSRF model. Per-IP, per-user, per-endpoint patterns. What's logged, where to read it, how to export. GDPR, SOC 2, DPAs, sub-processors. Self-service export for users and admins. Permanent deletion, what's retained, what's purged. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.