Security

Neovekk holds records about buildings that their owners rely on, so we try to be plain about how we protect them. This page describes the safeguards in place on the date above, says what is not in place yet, and explains how to report a vulnerability. Our Privacy Policy and Terms of Service cover the rest.

Report a vulnerability

Email support@neovekk.com with "Security" in the subject line. Tell us what you found, where, the steps to reproduce it and what an attacker could do with it. We will confirm we received your report, keep you updated while we investigate and fix it, and credit you if you would like.

Please:

only use accounts and data you are allowed to use; if you come across someone else's data, stop, do not keep it, and tell us;
do not change or delete data, degrade the service, send spam, or try phishing or other social engineering;
do not tamper with QR labels or equipment at anyone's building;
give us reasonable time to fix a problem before you tell anyone else about it.

If you follow these guidelines in good faith, we will not take legal action against you for your research. We do not currently pay rewards for reports.

Accounts are created only by invitation. Neovekk sets up each customer's first owner, and customers invite everyone else.
Passwords must be at least 8 characters. Our sign-in provider, Supabase, stores only a one-way hash of each password.
Anyone can turn on two-step sign-in with an authenticator app. Once it is on, a password alone does not sign in to that account. Administrators are prompted to turn it on.
Sign-in cookies expire 30 days after the last visit. Disabling or deleting an account ends all of its sessions.
Changing a password requires the current password, unless the person just arrived from a password-reset link.
Repeated attempts to sign in, reset a password, accept an invite, request access or look up labels are limited.
Single sign-on (SAML) is not available yet.

Who can see what

Each customer's records are kept separate by company and location. A person sees a location's records only as a company owner or administrator or through an active access grant for that location; belonging to a company does not by itself open its locations. A matching "deny" grant overrides other access for everyone except company owners and administrators.
Row-level security in the database applies these rules to every read made with a person's session.
Browsers cannot change records directly in the database. Apart from a few low-risk tables of their own (print settings, read markers and sticker orders), every change goes through our server, which checks the person's permissions first. Invitations, access grants, memberships, profiles, file records and audit logs can be written only by the server.
Locations can require that contractors' changes are reviewed before they apply. This is on by default.
A QR label carries only a code that points to the record, never a password or record details. Someone who is not signed in sees only the text the location's settings allow; by default that is a display name for the location and equipment, a partly hidden tag, the trade, the type, a general location, a short public summary and a safety notice. Public pages do not show photos, documents or floor plans.
Temporary access from a label is off by default. When a location turns it on, scanning alone still grants nothing: a signed-in person must ask for it, and it expires.

Files

Photos, documents, floor plans and Photo Spheres are kept in private storage. They are delivered through signed links that expire: viewing and download links within an hour, most within minutes; upload links within a few hours.
Large files move directly between the browser and storage over resumable, signed uploads rather than through our application servers.
Floor plans and Photo Spheres are processed in isolated Vercel Sandbox workers. Each job gets only short-lived credentials limited to that job, never our database keys.
Uploads are checked against allowed file types and size limits, and a file's contents must match the type it claims to be. Word and Excel files that contain macros are refused. Each photo's fingerprint (SHA-256 hash) is recorded so copies can be checked against the original, and markups never overwrite the original.
Not yet in place: uploaded files are not scanned for malware. Our file records have a scan status so a scanner can be connected, but none is connected today. Treat files from people you don't know with the same care as any email attachment.
Removed files can be restored during the location's recovery window before they are deleted, and proof in a finished Project can only be redacted, with a reason, by a location administrator.

Audit trail

Important actions are logged with who, what and when: changes to records, access and settings; reviews and approvals; file removals and restores; exports; and label scans and access decisions.
Notes keep their earlier wordings, and each piece of equipment has a history of what happened to it.
Audit logs can be written only by our server, not changed from a browser.

Encryption and infrastructure

All traffic to Neovekk uses HTTPS (TLS), and browsers are told to use only HTTPS for our site.
Our database, file storage and sign-in run on Supabase, and the website, app and processing run on Vercel. Both encrypt stored data at rest.
Our pages tell browsers not to let other sites frame them, not to guess file types, to limit what web addresses are shared with other sites, and to allow only the camera and motion sensors that scanning and Photo Spheres use (no microphone, location or payment access).
Keys and secrets stay on the server. Scheduled jobs, operator tools and processing jobs each use their own secret.
When something fails, the app shows a reference number instead of internal details.
Production refuses to start without its required database settings, and demo data and local sign-in shortcuts cannot be turned on in production.

What we don't have yet

Independent security certifications or audits, such as SOC 2 or ISO 27001.
Malware scanning of uploaded files.
Single sign-on.
Published commitments for uptime, backups or recovery times. If your organization needs them, ask us.

If something goes wrong

If we learn of a security incident that affects a customer's data, we will tell that customer's administrators without undue delay, explain what we know and what we are doing about it, and update them as we learn more.

Contact us

Security reports and questions: support@neovekk.com
NEOVEKK LLC, 13166 Imlay City Rd, Emmett, MI 48022, United States