Security at VistaFollow
Your customers' data is the core of your business. Here is exactly how we protect it.
(OWASP ZAP, June 2026)
for database and backups
in transit
in Cloudflare R2 (Europe)
Infrastructure
| Backend | Cloud-hosted API — Railway |
| Frontend | Cloudflare Pages (global CDN) |
| Database | Relational database — AES-256 encrypted at rest |
| Backup storage | Cloudflare R2 — Europe, AES-256 server-side encryption |
| Data in transit | HTTPS / TLS for all traffic between client and server |
Authentication & Access Control
| Session tokens | Short-lived access tokens with automatic renewal — sessions expire on logout |
| Password storage | Passwords are hashed and salted — never stored in plaintext |
| Multi-factor auth (MFA) | TOTP (RFC 6238) available for all users, with backup recovery codes |
| Single sign-on | Google SSO supported |
| Brute force protection | Rate limiting on all login and API endpoints |
| Role-based access | Five roles: owner, support, admin, member, readonly — principle of least privilege |
| Data isolation | All CRM data is strictly isolated per organisation — no cross-tenant access is possible |
Security Testing
VistaFollow was scanned on 21 June 2026 using OWASP ZAP 2.17.0 — the industry-standard open-source security scanner from the Open Worldwide Application Security Project. Both unauthenticated and authenticated scans were performed, covering all publicly exposed and login-protected API endpoints.
One low-severity finding (missing Cross-Origin-Resource-Policy header) was identified and resolved on the same day before this report was published. The 4 informational findings are not vulnerabilities — they include expected 401 error responses and internal filter parameter names flagged as false positives.
Security Headers
Backups & Recovery
| Frequency | Daily automated backups |
| Retention | 90 days in Cloudflare R2 (Europe), AES-256 encrypted |
| Restore testing | Monthly automated restore to an isolated test database — row counts and MD5 hashes compared against production. Owner notified by email with pass/fail report. |
| Recovery time (RTO) | Target: database restored within 2 hours in a disaster scenario |
| Recovery point (RPO) | Maximum 24 hours of data loss in a worst-case scenario |
GDPR & Data Rights
| Compliance | GDPR compliant. Data Processing Agreement (DPA) available on request. |
| Audit trail | All CRM create, update, and delete operations are logged with user, timestamp, and action — retained indefinitely per organisation |
| Login logs | Successful and failed login attempts logged and retained for 90 days |
| Data export | Full data export (JSON and CSV) available at any time — you own your data |
| Data deletion | Complete data deletion on request within 48 hours |
| Input validation | All API fields validated with max-length constraints and sanitisation — OWASP Top 10 applied during development |
Documentation Available on Request
The following documents are available to prospective customers and enterprise prospects on request:
- Security Policy — Information security and data protection policy (v1.0, June 2026)
- Data Processing Agreement (DPA) — GDPR-compliant data processing agreement
- System Architecture — Technical overview of infrastructure, data flow, and security controls
- OWASP ZAP Scan Reports — Full unauthenticated and authenticated scan reports (June 2026)
- Incident Response Plan — Procedures for detecting, reporting, and resolving security incidents
- Service Level Agreement (SLA)
Security questions?
Contact us at hello@vistafollow.com — for security vulnerability reports, document requests, or DPA signing.
Last updated: July 2026