✦Security

Connections

All traffic to blueveta.com uses HTTPS, and browsers are told to only connect securely to us for a full year, including subdomains (HSTS).

Browser protections

• A strict content security policy limits where scripts, images and media can load from.
• Other websites cannot embed BlueVeta inside their pages, which blocks clickjacking.
• Browser access to your location, camera, microphone and the browser payment API is switched off for our pages.
• Our pages are isolated from other sites' windows (same-origin opener policy).

Payments

Payments are handled by Stripe. Your card details go to Stripe, not to BlueVeta, and we do not store full card numbers. We keep only what we need for your receipts and account, as described in our Privacy Policy.

Your account

You can turn on two-factor authentication in your account settings for an extra step at sign-in.

Your photos and brand details

Your photos and brand details are used only to create your campaigns, and are never sold. How uploads and finished assets are stored is set out in our Privacy Policy and Terms.

Email

We publish SPF and DMARC records for blueveta.com so mail providers can check that email claiming to come from us really did. Our DMARC policy is currently in monitoring mode.

Hosting

BlueVeta runs on Cloudflare's infrastructure.

What we do not have yet

We are an early-stage company. We do not yet hold a SOC 2 or ISO 27001 certification, we have not published a third-party penetration test report, and we do not run a bug bounty program. We would rather say so plainly than imply otherwise.

Report a security concern

If you think you have found a security problem, please email office@blueveta.com with the word "Security" in the subject line and as much detail as you can. We will look into it.