Security
Your data, in plain words
What's true today, during the pilot, and what's coming. Nothing more.
Today
Sign-in without passwords
You sign in with a code by text message, a code or a link by email, or with Google or Apple where they're on: no password to remember or to steal.
Everyone sees only their own data
Every business is kept apart from the others in the database itself: one owner can't read another's data.
Read-only support
To help when something goes wrong, Velito's founder can open your business's app read-only, seeing what you see without being able to change or send anything.
Data in Europe
The database and photos are in a data centre in the European Union (Frankfurt), with Supabase. The app and websites are hosted by Vercel. Everything travels over an encrypted connection (HTTPS).
Who helps us
Supabase (database, photos and sign-in), Vercel (the app and websites), Anthropic (texts written with AI), Resend (email), Twilio (SMS codes, through Supabase) and, when it's on, OpenAI (voice transcription). Anthropic, Resend, Twilio and OpenAI are based in the United States and only receive data when you use the feature they handle.
Photos private until you decide
Job photos stay private until you put them on your website, and their GPS position is removed before upload.
Quote links that can't be guessed
The PDF link you send a client is long and random, works only for quotes you've sent and never shows up in search engines. Anyone with the link can open the PDF, so send it only to your client.
The AI, when it's on
When Velito writes for you, the text to work on goes through Anthropic, the AI provider: your voice note with your price list, a job's notes, the client's name in a reminder. To design your website it gets the business description and up to three small photos.
Your voice
Your voice note is transcribed by your phone's speech recognition (Google's or Apple's, for example) or, when server transcription is on, by OpenAI. The audio doesn't stay on our servers: Velito keeps only the text.
No third-party tracking
No advertising or profiling tools. We only count which screens and features are used, per business, with no content and no cookies, to improve Velito.
Crash reports
If something breaks, the app sends us the error message, the page and the browser, linked to your account if you're signed in. Never what you typed.
You approve every action
Velito prepares messages and documents, but nothing goes to your clients without your tap: messages leave from your own WhatsApp.
Delete everything whenever you like
In Settings you can delete your account: the business, the data and the photos go with it.
The Velito assistant
It answers from Velito's guides and a few details about your business (name, trade, town, plan, how many quotes and jobs), never your clients' data, and it can't do anything for you. Your question goes through Anthropic for the answer; first we remove card numbers, passwords and ID numbers. Conversations stay in your account, only you can see them and the founder may read them to improve the answers; they go with your account. Questions asked on Velito's website are kept for 30 days, without anything that identifies you.
Coming soon
Export your dataComing soon
You'll be able to download all your data in a file, whenever you like.
More people in one accountComing soon
With the right permissions for each.
GDPR and privacy
We handle data under the EU General Data Protection Regulation (GDPR). The privacy policy is a draft, to be reviewed by a lawyer before launch.
Read the policyFound a problem?
If you think you've found a security problem and you're in the pilot, tell us from the app by opening the assistant and tapping “Talk to a person”: the founder reads it. The contact form opens soon.
Contact page