Trust Centre · Verified Controls Only

Security at VEMO FuelIQ

This page documents the security controls currently implemented in our platform. We publish only what we can substantiate. Where a control is on our roadmap but not yet in place, we say so plainly.

Standard applied: This page does not claim ISO 27001, SOC 2, formal penetration testing, disaster-recovery RTO/RPO commitments, guaranteed uptime, or cross-region backup replication. Those items are not yet implemented at VEMO. When they exist, we will list them here with evidence.

Encryption & network security

TLS 1.3 in transit + HSTS

All traffic to vemofuel.com encrypted via TLS 1.3. HTTP Strict Transport Security enforced with a 2-year policy, includeSubDomains, and preload eligibility.

Database encryption at rest (AES-256)

Database volumes encrypted at rest via AWS RDS AES-256 (Supabase-managed underlying infrastructure).

Content Security Policy

Strict CSP restricting script/style/image/connection origins to a whitelist of trusted providers. No inline eval. Defence against XSS injection.

Defence-in-depth security headers

X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy locking down camera/microphone/geolocation/payment APIs by default.

Access control & tenant isolation

Row-level security (RLS) on data tables

Supabase row-level security policies enforced on customer-data tables. Each company's data is isolated from other tenants at the database engine level, not just the application layer.

Password hashing with bcrypt

User passwords hashed server-side using bcrypt (Supabase Auth default configuration). No plaintext storage.

Role-based access

Admin, operator, and vessel user roles enforced at the application middleware layer, backed by database policies.

Application audit trail

Administrative and data-modification actions captured in an internal audit-log table. Retention and per-event coverage documented internally; disclosure available on request under NDA.

Data handling & subprocessors

Our full subprocessor list is published in our Privacy Policy. Summary:

SubprocessorPurposeRegion
Supabase Inc.Database + AuthAWS ap-south-1 (Mumbai)
Vercel Inc.Application hostingUS (default region)
ResendTransactional emailGlobal (US-headquartered)
RazorpayPayment processing (India)India
Google AnalyticsWeb analyticsGlobal

Data portability + deletion (GDPR)

Fleet operators can export all voyage records, vessel data, and compliance calculations from the account Settings page at any time. Deletion requests processed within 30 days per privacy@vemofuel.com.

What we are working toward

The following controls are on our roadmap but are not yet implemented. We do not publish them as current capabilities.

We would rather have this list be short and honest than long and aspirational.

Reporting a security vulnerability

If you believe you have found a security issue affecting VEMO FuelIQ, please email hello@vemofuel.com with subject line "SECURITY". We aim to acknowledge within 2 business days.

Please avoid public disclosure until we have had a reasonable opportunity to investigate. We will keep you informed of remediation progress.