Security practices, described honestly.
VoyantIQ is early stage and does not hold a formal third-party security certification yet. What follows is a plain, accurate description of how the platform actually behaves today, not a compliance claim.
Authentication and Session Security
Sign-in is handled by Better Auth. Passwords are never stored in plain text, and invitation and trip-claim tokens follow the same hashed-token pattern Better Auth itself uses, only the raw value ever leaves the server, only its hash is ever persisted.
No Secrets in Logs
Environment validation errors name a missing variable, never its value. Operational health checks are built from presence and prefix checks, never from the credential itself.
Session Replay Masks Sensitive Input
Every form input is masked in session replay by default, along with any region that displays saved sensitive content as static text. No prompt, AI response, or personal content ever reaches analytics or AI telemetry.
Environment Separation
Preview and Production are distinguished explicitly, not inferred, and no hosted environment is allowed to depend on a local-only service.
Reporting a Concern
If you believe you've found a security issue, use the General or Support category on the Contact page. There is no bug bounty program at this stage, but every report is read by a real person.