Security Policy

• Per-account isolation — database rules enforce that records are readable only by the account that owns them.
• Private image storage — receipts and proof photos live in private storage, reachable only through signed, short-lived links.
• Encryption in transit — all traffic uses HTTPS.
• Device lock — an optional passcode plus auto-lock and balance masking (Private Eyes).
• Separate staff access — associate and admin access requires its own hashed code and is logged.
• Server-side verification — point awards, limits and anti-abuse checks run on the server, never in the browser.

Vaultline never asks for online-banking passwords, full card numbers, CVV codes, ATM PINs, or one-time bank codes. It does not connect to real financial institutions. If anything claiming to be Vaultline asks for these, it is not us — report it.

• Use a unique password and keep your email account secure.
• Turn on the passcode lock if you share your device.
• Never share associate or admin codes.
• Sign out on devices you no longer use.

Found a vulnerability? Report it through the report form with enough detail to reproduce it. Please do not access other members' data, degrade the service, or publish the issue before it is fixed. Good-faith reports are welcome and will not be held against you.

If a breach affects your records, we will notify affected accounts by email with what happened, what data was involved, and the steps to take.