security
How authorization, media confidentiality, and privacy are enforced in code.
vevibe enforces privacy in code and architecture rather than relying on user settings. This page outlines the technical boundaries protecting your data and relationships.
server-side authorization
Content access is evaluated directly in PostgreSQL via Row-Level Security (RLS) on every single query. Client-side authorization is never trusted.
Posts, stories, and comments are queryable only by accepted friends who share a mutual, server-verified friendship. Graph distance beyond direct accepted friends never grants content access.
media confidentiality
Photos and videos are stored in private Cloudflare R2 buckets with no public URLs. Media is served strictly through signed, expiring links issued by an edge worker that verifies session authorization before generating a token.
email isolation
Transactional email domains are separated to protect deliverability and reputation:
auth.vevibe.com: Dedicated to authentication, magic links, and security alerts.notify.vevibe.com: Dedicated to realtime activity digests.
Open tracking is disabled on every outbound email. I never insert invisible tracking pixels.
two-factor authentication
Account access supports standard Time-based One-Time Password (TOTP) two-factor authentication, compatible with standard authenticator applications.
what is not claimed
vevibe uses server-side authorization with encryption in transit (TLS 1.3) and encryption at rest. It does not provide end-to-end encryption.
For information on data retention and analytics, see the privacy policy. To report a security vulnerability, please contact team@mail.vevibe.com.