Last updated 13 October 2026
We build systems that hold other companies' catalogues, orders and customer data, so we hold our own website to the same standard.
How this site is built
- The website is pre-rendered static HTML. There is no server-side code on the public pages to attack.
- The small API behind the forms never fetches a URL a visitor supplies. That is done by a separate scanner on separate infrastructure with no access to our database or secrets.
- Secrets live outside the web root, never in the repository or in client-side code.
- HTTPS everywhere, with HSTS, a strict referrer policy and content-type sniffing disabled.
Client work
- Least-privilege access to client systems, granted per engineer and removed when the engagement ends.
- Credentials in a shared vault, never in chat or email.
- ISO 27001 certification is in progress.
Reporting a vulnerability
Email security@vezolabs.com with the details and steps to reproduce. We will acknowledge within two business days and keep you updated until it is fixed. Please do not access data that is not yours, degrade the service, or publish details before we have had a reasonable chance to fix the issue. We do not take legal action against good-faith research that follows these rules.
Machine-readable contact details are at /.well-known/security.txt.