What VIRA actually implements today. We only list safeguards that are in place.
Passwords are stored as salted PBKDF2 hashes. Sessions use HttpOnly, SameSite cookies, and every session is revoked when a password is reset. Verification and reset links are single-use, expiring, and stored only as hashes.
Every business’s data is scoped by organization. Private reads and writes derive the organization from the signed-in member, never from a value the browser supplies, and this isolation is covered by automated tests.
Authentication and public forms are rate limited, inputs are validated server-side, and customer-provided text is always rendered as plain text.
Found a vulnerability? Email hello@vira.com and we will respond as quickly as we can.
Questions? Contact hello@vira.com.