Become a partner
Security

Security, on hardware we own.

What we do to keep your data safe, and how to tell us when something looks wrong.

Last updated: May 27, 2026

Two NVIDIA DGX Spark machines of the kind Vannor owns and runs
[01] Data path

Your data takes one road.

From your site and Search Console to our hardware and back to your channels. No detour through an outside AI provider.

SourceYour dataSearch Console · CMS · Pixel
ContextBrand modelStored with us
ComputeVannor rackGB10 · DGX Spark
GateQuality + approvalYour rules
OutputYour channelsSite · ads · social
Never3rd-party AINo outside calls
[02] Controls

The controls we run.

How Vannor protects your data, from the disks to the sign-in link.

01

Infrastructure

Vannor runs on dedicated NVIDIA Grace Blackwell GB10 hardware that we own and operate — not on a shared third-party AI provider. Production data lives on encrypted disks (LUKS, AES-256). Backups are encrypted at rest, retained for 30 days, and located in the same jurisdiction as your workspace.

02

Network

  • All public traffic is served via Cloudflare with strict TLS 1.3
  • HSTS enforced with preload
  • Inter-service traffic stays on a private network
  • No raw database access from the public internet
03

Authentication & sessions

  • Sessions use HTTP-only, Secure, SameSite=Lax cookies signed with a rotating server-side secret
  • Magic-link sign-in tokens expire in 15 minutes and are single-use
  • Passwords (when used) are hashed with bcrypt at high cost
  • Each browser session is independently revocable from settings
04

Tenant isolation

Every query in Vannor scopes by organizationId at the application layer. Data from one workspace never trains the model for another. There is no shared inference cache across tenants — your brand voice, drafts, and analytics stay yours.

05

Payments

All payment data is handled by Stripe or PayPal. Vannor never sees or stores full card numbers. Both processors are PCI-DSS Level 1.

06

Sub-processors

We use a small set of sub-processors for narrow, well-scoped tasks:

  • Stripe / PayPal — payment processing
  • Cloudflare — edge routing, DDoS protection, TLS termination
  • Google Workspace SMTP — transactional email delivery for sign-in links and notifications

We do NOT use any third-party LLM provider for tenant inference. Generations stay on Vannor hardware.

[03] Vulnerability disclosure

Found something? Tell us.

[email protected]

Vulnerability disclosure

If you believe you've found a security issue, email [email protected]. Please include:

  • A description of the issue and how to reproduce it
  • The impact you believe it has
  • Your name / handle (we acknowledge researchers publicly with permission)

We aim to acknowledge every report within 2 business days and ship a fix or a written plan within 14 days for high-severity issues. We don't currently run a paid bug-bounty program but are happy to write recommendation letters and publicly credit responsible reporters.

Safe harbor

Good-faith testing performed in accordance with this policy will not be subject to legal action by Vannor. Don't access data that isn't yours, don't degrade service for other tenants, don't exfiltrate data beyond what's necessary to demonstrate the issue.

[04] Questions

Security questions.

General questions: [email protected]

Is my data sent to a third-party AI provider?

We do NOT use any third-party LLM provider for tenant inference. Generations stay on Vannor hardware.

Where does my data live?

Vannor runs on dedicated NVIDIA Grace Blackwell GB10 hardware that we own and operate. Production data lives on encrypted disks (LUKS, AES-256). Backups are encrypted at rest, retained for 30 days, and located in the same jurisdiction as your workspace.

Do you run a bug bounty?

We don't currently run a paid bug-bounty program but are happy to write recommendation letters and publicly credit responsible reporters.

Who do I contact with security questions?

General questions: [email protected]

Security

Your data stays on our hardware.

Every engine runs on hardware Vannor owns. Your content and data are never sent to an outside AI provider.

Partner access · We'll reply as soon as we can