Security
Security controls should be clear about their limits.
Vendale has security controls in the current source. Those controls are not the same as a signed, customer-accepted production release: the published Windows client is invite-only, and the customer-hosted server is private evaluation. Here is what is implemented and what is still awaiting acceptance.
Integration secrets belong on the server
Privileged provider tokens and server keys must stay on the server and out of the Windows client. Credential encryption is implemented in the current source; a customer must still protect the keys and configuration of the server they operate.
Source control · deployment review required
Workspace access is permissioned
Current-source APIs scope workspace records by organization and apply feature permissions. Automated coverage exists for selected tenant boundaries, but the complete isolation and role review has not passed on a matched customer release.
Implemented in source · full release acceptance open
Provider event checks are adapter-specific
Connected providers have their own event-validation and duplicate-handling paths. A replay or delivery guarantee depends on the provider and adapter; live third-party delivery has not been accepted for the current customer release.
Automated source coverage · live provider acceptance open
Audit coverage is feature-specific
The application records audit events for defined administrative and business changes. Coverage depends on the feature; we do not claim that every read, write, or system event is captured in one complete immutable log.
Feature-specific records · see current feature evidence
Customer-hosted servers need release acceptance
The public manifest lists Ubuntu 24.04 LTS x64 for private evaluation. Local synthetic install and restore work is not the same as a production install; clean customer-hosted upgrade, recovery, and rollback acceptance remains open.
Private evaluation · customer production not validated
No public signed release is listed
The published record is v0.2.0 and invite-only. It lists no public installer URL or checksum, and it does not identify a matching server version. We do not present an independently audited or certified deployment as available.
Check the live release record before installation
Current release status
Check what can be evaluated today.
v0.2.0
invite-only · current public record
No public installer
Windows URL and checksum are not published
Private evaluation
Ubuntu server · version fit confirmed by engagement
Not production-accepted
Customer-hosted release and recovery remain open
How to verify each claim yourself
Artifact integrity
Vendale currently distributes installers by request. For an approved artifact, compare its SHA-256 with the release-specific value delivered alongside it. The public manifest states whether a public download is available.
/api/releases/latest → current release recordBehavioral claims
The application source includes memory-only token handling, append-only audit events for covered actions, and organization-scoped queries. Confirm the controls against the exact release and configuration. The deployment kit includes verification procedures, but customer-hosted production use has not been validated.
/changelog → every fix, with its root causeCheck the release record before installation.
The public record has no installer or checksum, and the customer-hosted server remains a private evaluation. Contact Vendale to ask about availability, release pairing, and the evidence needed for your environment.
Request access