Encrypted in transit and at rest.
Connections use TLS. Database storage is encrypted at rest by Neon. Secrets are stored as Cloudflare Workers secrets, not in the deployed code.
Workspace data is kept apart.
Product data is stored with its workspace's tenant id, and queries filter on it. No customer-facing API reaches across workspaces. API keys and sessions belong to one workspace, and uploads go to storage prefixed by workspace. Two things are shared on purpose: user accounts (one person can belong to several workspaces) and a list of addresses that have hard-bounced. Vlozi staff can see workspace data through an internal operations dashboard behind Cloudflare Access, which is used for support and abuse handling.
Your content never trains a base model.
Vlozi does not train or fine-tune models on your blog posts, newsletters or chat transcripts. When a feature uses an AI provider, only the content needed for that request is sent, and the providers are listed on the sub-processors page.
Auth posture.
Accounts need a verified email address and a password, or Google sign-in. Two-factor authentication (an email code, a phone code or an authenticator app) is available on every plan. Session tokens are short-lived. API keys are created in the dashboard for one workspace, can be limited to specific permissions, and can be revoked at any time.
Where Vlozi runs.
| What | Who | Note |
|---|---|---|
| Edge compute | Cloudflare Workers | global |
| Primary database | Neon Postgres | Mumbai (ap-south-1), point-in-time recovery |
| Object storage | Cloudflare R2 | files stored under a prefix per workspace |
| Transactional mail | AWS SES | domain verified, DKIM signed |
| Fallback mail | Resend | Vlozi's own service mail only (login codes, invitations) |
| Analytics | Plausible | cookieless, marketing site only; not loaded when your browser asks to save data |
Every provider that may handle personal data, with what it does and what data is involved, is on the sub-processors page: the one current list.
Backups, retention, export.
- — Neon keeps continuous backups and supports point-in-time recovery within its retention window.
- — Export from the dashboard: form submissions (CSV or JSON), comments (CSV) and each campaign's recipient report (CSV). Everything else is available through the API, or email [email protected] and we send you a copy within 30 days.
- — Cancel a paid plan: pack credits stay; subscription credits drain at cycle end; cancelling deletes nothing. Delete a workspace: it leaves your dashboard and can no longer be exported, so copy what you need first; email [email protected] to have its data erased, and we act within 30 days unless the law requires retention.
Found something? Tell Vlozi quietly first.
Email [email protected] with details. Vlozi acknowledges in one business day, fixes confirmed issues, and credits you in the changelog if you want public credit.
No bounty programme today; do not test against tenants you don't own; do not exfiltrate data beyond what's needed to demonstrate the issue.
Compliance posture (GDPR, India DPDP) is being formalised — see the privacy policy for current data-handling commitments, and the changelog for what shipped this cycle.