Security

How we protect your data

• Encryption in transit: traffic to and from MyVisito is encrypted using TLS.
• Encryption at rest: your data is stored with encryption at rest through our infrastructure providers.
• Workspace isolation: every workspace is separated from others at the database level, so one customer cannot access another customer’s data.
• Account protection: passwords are stored in hashed form through our authentication provider, and you can sign in with Google.
• Payments: card payments are handled by Stripe, a PCI-DSS certified provider. We never store your full card number.
• Access control and monitoring: access to production systems is restricted to what is needed, and we monitor for unusual activity.

Reporting a security issue

If you believe you have found a security vulnerability, we want to hear from you. Email security@myvisito.com with a clear description, the steps to reproduce it, and any supporting details such as screenshots. You may report anonymously.

Testing guidelines

• Only test against your own account and data.
• Do not access, modify, or delete data that is not yours.
• Do not run denial-of-service attacks, spam, or social engineering against our team or users.
• Give us a reasonable time to investigate and fix an issue before sharing it publicly.

Our commitment to researchers

If you make a good-faith effort to follow these guidelines while researching and reporting a vulnerability, we will not pursue or support legal action against you for that research, and we will treat your report as authorized. We will acknowledge your report within a few business days and keep you updated as we work on a fix.

We do not run a paid bug bounty at this stage, but we are grateful for responsible disclosure and are happy to credit researchers who help us keep MyVisito safe.

More information

For how we handle personal information, see our Privacy Policy. For anything else, contact support@myvisito.com.