Security

Vorexa Core has no public sign-up. Accounts are created by the platform administrator through an invite-only flow, and account creation through any other path is blocked at the database level.

Every table in the database is protected by row-level security policies scoped to the signed-in account (owner_id = auth.uid()). One account cannot read or modify another account's records through the application.

The Health and Vault areas re-lock after 15 minutes of inactivity and require your account password to re-enter. A one-tap privacy blur hides sensitive values (amounts, health figures) anywhere on screen without navigating away.

Actions taken in the Vault module (creating, updating and deleting documents) are recorded to an append-only audit log. Audit coverage is being extended to other sensitive areas over time.

All traffic to the platform is served over HTTPS/TLS. Data is stored in a managed Postgres database (Supabase). We do not currently claim field-level encryption for Vault or Health records beyond what the underlying infrastructure provider offers by default — we will update this page if and when that is independently verified, rather than describe it as "encrypted" in advance.

If you connect a Google account, we request the minimum scopes needed to read your calendar events (calendar, openid, email). The connection is one-way: we read your events, we do not write to your Google Calendar. You can disconnect at any time from Settings.

If you believe you have found a security issue, please report it to mornay@vorexa.co.za rather than testing it against live account data. We will acknowledge reports and work through the fix with you.