Vendale engineering
Security and privacy
How workspace access, server-side controls, and human-reviewed AI are designed.
The current public record lists v0.2.0 as available by request. Check the release record for version-specific availability and compatibility before following setup steps.
Maintained with the code · Download .md
Vendale is designed to keep workspace data under server-side access controls. This page describes product behavior and makes no certification or compliance claim.
Workspace access
API requests are authenticated and checked against workspace membership and permissions. User access and workspace records are scoped by the backend; the desktop or browser client is not the authority for business permissions.
AI safeguards
AI connections and provider credentials are configured on the backend. AI-generated replies are draft-only and require an explicit human action before sending. AI usage and selected context are bounded and permission-filtered by the server.
Credentials and customer data
Do not place privileged provider tokens, database credentials, webhook secrets, or private keys in a desktop or browser client. Operators should keep production secrets in the server's protected configuration and restrict access to the people who administer the deployment.
Deployment and assurance
Available deployment controls depend on the release and hosting environment. Ask the Vendale team for the current security documentation, data-processing terms, and deployment details for your evaluation. Vendale does not claim a third-party certification on this page.
Practical guides live in the help center; release history in the changelog.