Security principles
VAXERON is being designed around least-privilege access, explicit workspace membership, server-side authorization and separation between hospitality customers. Public guest experiences expose only information intentionally published for guests; operational workspaces require authentication.
Identity and access
- Invited accounts and authenticated sessions for back-office access.
- Workspace roles that limit administrative and operational actions.
- A protected platform-administration boundary separate from customer workspaces.
- Server-side validation for sensitive requests rather than reliance on interface controls alone.
Tenant isolation
Customer records are associated with an organization and access is checked against authenticated membership. Database row-level security and tenant-scoped server operations form part of this model. Cross-tenant tests and migration reviews are treated as release-critical work.
No system should be considered infallible. If you believe tenant isolation or authorization has failed, stop testing and report it privately.
Infrastructure and operations
VAXERON uses managed hosting, database and authentication providers and HTTPS for production traffic. Operational logging, dependency maintenance, database migrations and production configuration are reviewed as part of release work. Formal recovery objectives, audit commitments and service levels will be documented before commercial launch rather than overstated during the pilot.
Responsible disclosure
Report a suspected vulnerability to hello@vaxeron.com. Include the affected page, the observed behavior and safe reproduction details. Do not access other people's data, degrade the service, use automated high-volume testing or publish the issue before VAXERON has had a reasonable opportunity to investigate.
Security enquiries
Pilot customers may request further information at hello@vaxeron.com. A formal security schedule, incident-notification commitment and Data Processing Agreement will accompany commercial customer contracts.