VisualPinEncryption
All traffic between your browser, our edge, and our origin servers is protected with TLS 1.3. We use HSTS preload, modern cipher suites only, and rotate certificates automatically. Data at rest is encrypted with AES-256, with keys managed through our cloud provider's KMS and rotated quarterly.
Access control
For your team
- Role-based permissions: Owner, Admin, Editor, Viewer
- SSO via Google, Microsoft, and SAML (Agency plan)
- Two-factor authentication available on every plan
- Session expiry and forced sign-out on password change
For guest reviewers
- Per-project share tokens (revocable)
- Optional password protection on guest links
- Guests can comment and reply; only the owner can resolve
- IP and user-agent logged on every guest action for audit
Compliance
- GDPR-ready: data subject requests fulfilled within 30 days
- SOC 2 Type II audit in progress, expected H2 2026
- EU data residency option for Business and Agency plans
- Standard Contractual Clauses available on request
Infrastructure
VisualPin runs on a hardened, multi-region cloud platform with daily encrypted backups (35-day retention), automated failover, and 24/7 monitoring. We deploy through immutable infrastructure — every release is reproducible and signed.
Vulnerability disclosure
Security researchers are welcome. Report findings privately to security@visualpin.app and we'll respond within one business day. We do not pursue legal action against researchers acting in good faith under our safe-harbor policy.
Incident response
If a security incident affects your data, we'll notify you within 72 hours via your account email and post a public status update. Our incident response process follows the NIST 800-61 framework, with post-mortems published for major events.
Data deletion
You can delete any project from your dashboard. Deletion is immediate from the live database and propagates to encrypted backups within 35 days. On account closure, all your data and customer feedback is purged.