Security
Last updated: 26 September 2026
Passwords
Passwords are hashed with bcrypt before they are stored. We do not store, log, or have any way to view your original password.
Sessions
Sign-in issues an HTTP-only, same-site session cookie, so your session token is not readable by page scripts and is not sent to other sites. Cookies are marked secure in production, meaning they are only ever sent over HTTPS.
Abuse protection
Login and admin-login endpoints are rate-limited per IP address to slow down credential-guessing attempts. Every login and signup attempt (success or failure) is recorded with a timestamp and IP for account security review.
Admin access
Administrative endpoints require a separate authenticated admin session and are not reachable with a normal user login. Admin actions such as viewing accounts are logged.
Infrastructure
The application is hosted on Vercel. Account, profile, and analysis data is stored in a managed PostgreSQL database (Neon). We do not run our own physical servers.
Reporting an issue
If you believe you have found a security issue, please email hello@venturelens.ai directly rather than testing it against other users’ accounts.
This page describes our actual current practices. VentureLens is not yet SOC 2, ISO 27001, or otherwise formally certified, and has not undergone an independent third-party security audit.