Legal
SaaS Data Compliance
Veyro AI is a multi-tenant platform, which means many contractor businesses share the same infrastructure while their data remains strictly separated. Isolation is enforced at the database layer through row-level security policies scoped to workspace ownership, not merely by filtering in application code. A request carrying one workspace's credentials cannot read or write another workspace's leads even if the interface were bypassed entirely.
Privilege escalation is treated as a first-class risk. Roles and billing status are held in dedicated records rather than on user-editable profile fields, and database-level safeguards block client-side attempts to grant plan, admin or billing privileges. Automated security scanning runs against the schema, and findings are triaged rather than accumulated.
Email compliance is a shared responsibility. We authenticate outbound sending domains, deliver from your verified business sender address, BCC the workspace owner so there is always an independent record of what was sent, and log delivery outcomes. You remain responsible for contacting only people who enquired with your business and for honouring opt-out requests promptly.
Access control
Authentication is handled by a managed identity provider with hashed credentials and session tokens; anonymous sign-up is disabled. Internal access to production data is limited to personnel who require it to operate the Service, and privileged database credentials are not exposed to application code paths that serve end users.
Data residency, backups and continuity
Workspace data is held in a managed cloud database with automated backups. Restoration procedures are tested against the schema and its security policies, so a recovery cannot silently reintroduce weaker access rules than production.
Sub-processor governance
We use a deliberately small vendor set: managed database and authentication, transactional email, payment processing, and AI inference. Each receives only the minimum data needed for its function, and none is authorised to use contractor or homeowner data for its own marketing.
Incident response
Suspected security incidents are investigated immediately, contained, and — where a breach affects personal data — reported to affected workspace owners with the facts known, the scope, and the remediation taken, within the timeframes required by applicable law.
Last updated: September 2026.