Skip to main content
Vecaria

Security

Last updated: 2026-09-12

Local-first by design

Most tools run entirely in your browser using WebAssembly. Your files never leave your device for local processing, which removes an entire class of server-side risk.

Cloud processing

When you choose cloud processing (or exceed the local size threshold), files are uploaded over TLS to object storage, processed, and deleted according to the retention policy. Free results are ephemeral; Pro links last 30 days and can be shredded on demand.

Account and payments

Authentication uses secure, httpOnly session cookies. Payments are handled by Stripe; we never store card numbers. We store only subscription status and identifiers.

Platform controls

  • Role-based access control and least-privilege administration;
  • Rate limiting on authentication, API and MCP endpoints;
  • Idempotent billing and usage ledgers;
  • Audit logging of administrative actions;
  • Automated checks for third-party license compliance.

Data retention

No long-term file storage for Free. Pro files are retained only as configured and are deletable at any time. You can export or delete all account data from the account page.

Vulnerability disclosure

Please report security issues to support@vecaria.com with steps to reproduce. We aim to acknowledge within 3 business days. Please do not access or modify other users' data, and give us reasonable time to fix before public disclosure.