Application controls
Slack commands, events, and interactive actions require an HMAC signature and reject timestamps older than five minutes.
Google authentication uses PKCE, single-use short-lived state, a browser-bound callback, verified email claims, and immutable provider identifiers. Vigil does not store Google access tokens.
Paddle webhook signatures are verified against the unmodified request body. Event identifiers are stored to prevent duplicate processing.
Slack, Vanta, Drata, and customer-provided AI credentials are encrypted using AES-GCM before database storage.
Decrypted credentials are limited to server-to-server operations and are not returned to the browser after storage.
Vigil requests only the Slack permissions needed to deliver assignments, collect responses, and send reminders. Vigil does not request permissions to read channel history, private messages, or shared files, and keeps learner responses ephemeral where the workflow allows it.
Training records are designed to retain lesson version, score, attempt, learner, and completion timestamps.
Infrastructure and data protection
Vigil runs on a single production deployment using Cloudflare Workers, Cloudflare D1, and private Cloudflare R2 storage for generated evidence artifacts. Network traffic is served over HTTPS. Production credentials are stored as encrypted platform secrets, while customer-supplied integration credentials are encrypted at the application layer before persistence.
Vigil does not currently operate a separate hosted staging environment. Changes are validated through automated checks before deployment. Local development data is not used as production customer data. If Vigil adds another hosted environment, its credentials and customer records will be kept separate from production.
Customer responsibilities
- Control administrator membership and remove access promptly during offboarding.
- Configure Slack and optional Vanta, Drata, and AI integrations according to organizational policy.
- Avoid placing unnecessary regulated or confidential data into custom lessons and AI prompts.
- Review training assignments, evidence exports, retention requirements, and integration destinations.
- Report suspected compromise or incorrect permissions promptly.
Assurance status
Vigil performs automated dependency checks, application tests, migration validation, and live deployment health checks. Vigil has not completed an independent penetration test or obtained a SOC 2, ISO 27001, or similar certification. Backup restoration exercises, centralized production alerting, access reviews, incident-response exercises, secret scanning, and a formal vulnerability-management program remain on the operational roadmap. Vigil will not describe an external assessment or certification as complete unless it has been performed by a qualified independent assessor.
Responsible disclosure
If you believe you have discovered a vulnerability, do not access customer data, disrupt the service, or publicly disclose the issue before Vigil has had a reasonable opportunity to investigate. Email support@vigilsecurity.app or submit the contact form and select “Security report.”