Security at Vialode

Vialode is early. The honest way to describe our security is to separate what is in place today from what is not built yet, so you can decide what you are comfortable sending us.

What the service actually is right now

  • A static website plus one form endpoint. There is no customer login, no dashboard and no API
  • Documents are sent to us by email, processed, and not kept. We do not store your original file
  • Each extraction is run and reviewed by a person, so nothing is returned unseen
  • The only data we hold is what you typed into a form: your email address, and a company name and role if you gave them

Infrastructure and transport

  • Hosted on Cloudflare. The database is reachable only from our own server-side code, never directly from the internet
  • All traffic is served over HTTPS
  • Data at rest is encrypted by Cloudflare
  • A managed web application firewall and bot protection sit in front of the site

AI processing

  • Document content is sent to Anthropic over an encrypted connection and processed under their commercial terms, which do not use API inputs to train models
  • Only the document content is sent. Your email address and account details are never sent to the AI provider
  • Anthropic is named as a sub-processor in our privacy policy rather than left unstated

Privacy of this website

  • Analytics are removed entirely for visitors in the EEA and the UK, because we do not ask for consent and will not set non-essential analytics without it
  • Webfonts are self-hosted, so loading a page makes no request to a third-party font service
  • Email addresses are masked from session replay recordings
  • Deletion on request: email us and we remove your record

Before we handle production document volumes

These do not exist yet. They are listed because you are entitled to know what is missing, not as a description of what you get today.

  • Customer accounts, with per-organisation data isolation and access controls
  • Configurable retention periods instead of a blanket discard
  • Abuse controls and rate limiting on a self-serve upload endpoint
  • An executed data processing agreement with each sub-processor, and a signed DPA we can offer customers rather than a template
  • An independent security review by someone who is not us
  • An authenticated API, if and when customers ask for one

What this means in practice

Send us redacted documents if the contents are commercially sensitive. We would rather run a redacted bill of lading than have you send something you are not comfortable sharing with a company at this stage. If you need tenant isolation, audited retention or a countersigned DPA before you can share anything, say so and we will tell you honestly when we get there instead of claiming we already have.

Responsible disclosure

Found a security issue? Email [email protected]. It reaches a person, and we aim to reply within two working days.

Last reviewed 10 October 2026. This page describes the current implementation, not an aspiration. If something here is wrong or out of date, that is a bug: tell us at [email protected]. See also our privacy policy.