This page is for anyone who must assess the security of Venzeo™, such as your IT or data protection team.
Encrypted connections and email
Every connection between your browser or phone and Venzeo uses HTTPS, so this traffic is encrypted in transit. Plain HTTP requests to our API are redirected to HTTPS. The web app also sends an HSTS header, which tells browsers to connect only over HTTPS.
Our email domains are protected with SPF and DKIM records. The venzeo.com domain also has a DMARC record that tells mail servers to reject emails that fail these checks.
Sign-in, sessions and audit trail
You can sign in to the web app in three ways:
- with a one-time sign-in link sent by email (passwordless sign-in, so Venzeo never stores a password for you);
- with a Google account;
- with a Microsoft or Office 365 account.
After sign-in, your session is kept in a secure, HTTP-only cookie that expires after 14 days. The person who registers your company’s Venzeo account gets a longer first session: it lasts 180 days from registration.
Venzeo keeps an audit trail of activity on reports, such as new reports and changes to them. Administrators of your organisation can see it, and entries are kept for 180 days (about 6 months). To find an entry, see Checking who changed a report in the audit log.
Where your data is stored
Venzeo runs on managed cloud platforms:
- The web app runs on Cloudflare.
- The API, the background processing and the database run on Heroku (Salesforce).
- Photos, videos and exported files are stored with Amazon Web Services (AWS) in Frankfurt, Germany (AWS region eu-central-1).
Some service providers, for example for error monitoring, process technical data outside the European Union.
Security checks
Every code change to the web app and the API is scanned for software dependencies with known security vulnerabilities. A change with a critical finding is blocked. You can also check our public configuration yourself with these tools:
- SSL Labs TLS test
- SSL/TLS vulnerability and configuration scan
- TLS version test
- Server signature test
- X-Content-Type-Options header test
- Security headers test
- HSTS (HTTP Strict Transport Security) test
- DNSSEC test
- Google Safe Browsing check
- SPF record test
- DMARC record test
Checked on 9 October 2026 against the current Venzeo release.