Security at VrittOS
Last updated: 15 August 2026
VrittOS touches the two things engineering teams guard most: their source code and their roadmap. Here is exactly how we protect them — stated plainly, with no badges we haven't earned.
Your code stays in your repositories
VrittOS never hosts a copy of your codebase as the system of record. Code is generated into feature branches in your GitHub repositories via scoped OAuth tokens, and delivered as pull requests your team reviews. Direct pushes to protected branches are never made. Revoking the token in GitHub instantly removes our access.
No training on your data
We do not train AI models on your code or content. Our model providers process requests under terms that exclude training on API inputs and outputs.
Infrastructure
- Hosted on Microsoft Azure (UK and EU regions) — isolated container workloads, managed SQL, and Azure Key Vault for secrets.
- All traffic is encrypted in transit (TLS 1.2+); data is encrypted at rest.
- Integration tokens are encrypted and never exposed to the browser or logs.
- Every tenant's data is isolated by organisation with role-based access control.
Application security
- Authentication via passwords (hashed with modern KDFs) or Google, LinkedIn, and Microsoft sign-in; sessions use short-lived tokens with rotating refresh tokens and reuse detection.
- Rate limiting and lockout on authentication endpoints.
- Approval gates mean the platform cannot take irreversible actions — Jira writes, code generation, implementation — without an explicit human decision.
- Audit logging of significant account and workflow actions.
Payments
Card data is handled entirely by Stripe (PCI DSS Level 1). We store only subscription state, never card numbers.
Where we are on certifications
We are an early-stage company and do not yet hold SOC 2 or ISO 27001 certification. We build to those control standards and intend to pursue certification as we grow. If your security review needs specifics in the meantime, ask us directly — we answer questionnaires honestly and quickly.
Reporting a vulnerability
Found something? Email security@vrittos.ai. We acknowledge reports within 2 business days and won't take legal action against good-faith research.