Security practices
Data Encryption
All data in transit is encrypted using TLS 1.2 or higher. Sensitive data at rest is encrypted using AES-256. API keys and credentials are never stored in plain text.
Access Controls
Role-based access control (RBAC) restricts internal access to production systems. Two-factor authentication is required for all engineering and administrative accounts. Principle of least privilege is enforced.
Infrastructure Security
The Platform is hosted on enterprise-grade cloud infrastructure with network-level firewalls, DDoS protection, and automated threat detection. Production environments are isolated from development and staging.
Security Audits
We conduct regular internal security reviews. As the Platform scales, we intend to commission third-party penetration testing and engage an independent security firm for annual audits.
Incident Response
We maintain an incident response plan covering detection, containment, eradication, and recovery. Data breaches affecting personal data are reported to the relevant supervisory authority within 72 hours and affected users are notified promptly.
Dependency Management
We monitor third-party dependencies for known vulnerabilities using automated tooling. Security patches are applied on a priority basis. Supply chain security is reviewed as part of our development workflow.
Responsible vulnerability disclosure
We welcome good-faith security research. If you discover a potential vulnerability, please follow our coordinated disclosure process.
Email security@virtualsilvr.com with a clear description of the vulnerability, steps to reproduce, and your assessment of potential impact.
We will acknowledge receipt within 48 hours and provide an initial assessment within 5 business days.
We will work to remediate confirmed vulnerabilities in a timeframe commensurate with severity. We will keep you updated on progress.
We follow a coordinated disclosure model. We will discuss public disclosure timing with the reporter after the issue is resolved.
Scope and responsible use
Please do not: access user data beyond what is necessary to demonstrate the vulnerability; perform automated scanning at a scale that degrades service availability; publicly disclose vulnerabilities before we have had the opportunity to remediate; or use findings for any purpose other than improving our security. We will not pursue legal action against researchers who act in good faith and follow this policy.
Security questions or concerns?
For non-urgent security questions, general enquiries about our security programme, or data protection matters, contact us at: