Trust Center
How VestisLabs protects your data and keeps the platform running. Everything on this page describes controls we run today.
Last updated 10 November 2026
At a glance
-
Hosted in the EU
The platform and its databases run in Germany.
-
Encrypted in transit
Every connection uses HTTPS with TLS 1.2 or newer.
-
Automated backups
Databases are backed up frequently and stored off-site with a separate provider.
-
Role-based access
Brand admins control what each team member can see and do.
-
Controlled AI providers
Product AI features only use approved providers that do not collect your data.
-
Payments by Stripe
We never receive or store your card details.
Infrastructure and hosting
- EU hosting
- The VestisLabs platform and its databases are hosted in EU data centres in Germany. Files you upload are kept in managed cloud storage.
- Infrastructure as code
- Our infrastructure is defined in code and every production change is deployed from version control through an automated pipeline, so every change is traceable and repeatable.
- Secret management
- Application secrets are kept in a dedicated secrets management service and delivered to services at runtime.
Data protection
- Encryption in transit
- Every connection to VestisLabs uses HTTPS with TLS 1.2 or newer. Plain HTTP is redirected to HTTPS, and HTTP Strict Transport Security tells browsers to always connect securely.
- Backups
- Our databases are backed up frequently and automatically. Backups are stored off-site with a separate cloud provider, kept for a limited period and locked down from public access. We are alerted if a backup fails or falls behind schedule.
- Payment data
- Payments are processed by Stripe. VestisLabs never receives or stores your card details.
- Log retention
- Application logs and metrics are kept for a limited period and then deleted.
Accounts and access
- Passwords
- Passwords are never stored in readable form. We keep only a strong one-way hash.
- Sign in with Google
- You can sign in with your Google account instead of a password.
- Sessions
- Signing out revokes your session on our servers immediately, and session tokens are stored only in hashed form.
- Role-based permissions
- Access inside VestisLabs is role-based and scoped to each brand. Brand admins decide what each team member can see and do.
- Support access
- When our support team needs to see your account the way you do, they use a dedicated support mode that only senior administrators can start. It is time-limited and every session is recorded in an audit log.
- API keys
- API keys are stored only as one-way hashes. Each key belongs to a single brand, carries specific permissions, can be given an expiry date and can be revoked at any time.
- Connected apps
- Connected apps use OAuth 2.0 with PKCE and single-use authorization codes.
- Webhooks
- Webhooks we send are signed so you can verify they came from us, and their signing secrets are encrypted at rest. We verify the signature of every webhook we receive from our payment and commerce partners.
AI and your data
- Approved providers only
- AI features that process your product content, such as product enrichment and image and document analysis, send requests through an AI gateway to an approved list of model providers (listed under Subprocessors). Requests are only routed to providers that do not collect user data, and they are never silently sent to another provider.
- Help assistant
- The in-app help assistant uses an AI provider (listed under Subprocessors) to answer questions about using VestisLabs. It receives your question and basic account context, such as your email address and the brand you are working in.
Operations and reliability
- Patching
- Our servers receive security updates automatically, applied in planned maintenance windows.
- Redundancy
- Our main database and application services run redundantly across multiple servers.
- Monitoring
- We monitor availability, error rates, response times, certificates and backups continuously, with automated alerts to our engineering team.
Subprocessors
Third parties that process data on our behalf to deliver the VestisLabs platform.
| Provider | Purpose | Data involved |
|---|---|---|
| Hetzner Online | Cloud hosting for the platform and databases (Germany) | All platform data |
| Google Cloud | File storage, database backups, secret management | Uploaded files, backups |
| Sign in with Google, reCAPTCHA, address geocoding | Name and email, browser signals, supplier addresses | |
| OpenRouter | Routing requests to AI model providers | Content sent to AI features |
| Google, OpenAI, Microsoft Azure, Anthropic, Perplexity | AI model providers, reached through OpenRouter | Content sent to AI features |
| OpenAI | In-app help assistant | Your question and basic account context |
| Exa | Web search for AI visibility tracking | Tracking prompts |
| Stripe | Payments and billing | Billing name, email, VAT number |
| Resend | Transactional email | Recipient name and email, email content |
| Sentry | Error monitoring | Error details, technical and user context, session replays |
| PostHog | Product analytics | Usage events, name and email |
| CloudConvert | Converting design files to images | Uploaded Illustrator files |
| OpenStreetMap Foundation | Geocoding and map display | City and country, IP address for map tiles |
| Cloudflare | DNS | None |
Shopify and WooCommerce receive data only when you connect them to your VestisLabs account.
Security reviews
Need more detail for your vendor or security review? We are happy to answer security questionnaires and walk your team through how the platform is built. Email support@vestislabs.com.
Report a security issue
If you believe you have found a security vulnerability in VestisLabs, email support@vestislabs.com with "Security report" in the subject. Please include the steps to reproduce it, and give us reasonable time to fix the issue before sharing it publicly.