Authentication and data isolation
Every page and API route that touches customer data requires user sign-in. In our database, each project data is isolated using row level security so one customer can never read another customer data.
Encrypted connections and secrets
All traffic between your browser and Veeylo is encrypted using HTTPS with strict transport security (HSTS). Provider credentials live only on our secure servers and are never exposed to the web browser.
API keys and agent integrations
API keys generated for AI agents are shown only once upon creation. We store them only as a cryptographic SHA-256 hash, meaning even our staff cannot view your raw secret key.
AI agents connect through an MCP endpoint protected by the same spending controls and require an explicit cost ceiling for every paid call.
Spending caps and atomic reservations
Veeylo never spends on its own. Every paid check runs only when you ask for it, and the cost is always displayed beforehand.
Your balance is protected by daily and monthly caps. We use an atomic spend reservation so parallel requests cannot exceed your chosen spending limit.
Reporting security concerns
We welcome reports from researchers and customers. If you find a security bug or have a concern, email us at hello@veeylo.com and we will investigate promptly.