Security
How Vendeal protects your data.
The protections built into every account, order and payment.
- Card and bank details never touch our servers
- Passwordless sign-in with optional two-step verification
- Every record is scoped to your organization
Payments
Card and bank details are handled entirely by our payment processor. Vendeal never stores full card or bank account numbers.
Sign-in
There is no password to steal or reuse. Sign in with Google, an emailed link or your phone, and add two-step verification with an authenticator app for extra protection.
Access control
Every role, on every side of the platform, has explicit permissions, and they are enforced on the server, not just hidden in the interface.
Data isolation
Your organization’s records are visible only to your organization. Shared records like purchase orders and invoices are visible only to the buyer and seller on that record.
Report a vulnerability
If you've found a security issue, we want to hear about it before anyone else does. Email details to security@vendeal.app and we'll respond.
Email security@vendeal.appQUESTIONS ABOUT SECURITY
Does Vendeal ever see my card or bank account number?
No. Card and bank details are handled entirely by our payment processor and are not stored in Vendeal.
Do I need a password?
No. You sign in with Google, an emailed link or your phone. You can also turn on two-step verification with an authenticator app in your account settings.
Can one organization see another organization’s data?
No. Your organization’s records are visible only to your organization. Shared records like purchase orders and invoices are visible only to the buyer and seller on that record.
Are permissions enforced only in the interface?
No. Every role has explicit permissions, and they are checked on the server for every request.
How do I report a security concern?
Email security@vendeal.app with the details and we will respond.
For anything else, visit the Support Center.
See it in the platform.
Access control and data isolation aren't just a page — they're how every org boundary actually works.