VVetraSign in
Draft notice: These documents are working drafts authored in-house. Have qualified Indian counsel review before relying on them in a customer-facing contract.

Security Statement

Effective 2026-05-28

Vetra holds clinical, financial and identifying data for veterinary practices. The summary below describes the controls we operate. We are actively maturing toward ISO 27001 and SOC 2 readiness — this document reflects current state, not certification.

1. Infrastructure

  • Hosting: Microsoft Azure App Service, Southeast Asia region.
  • Database: Supabase-managed PostgreSQL with row-level security policies enforcing tenant isolation, mirrored in application RBAC.
  • TLS:Azure-managed Let's Encrypt certificates, HTTPS-only with HSTS.
  • Image supply chain: container images built in GitHub Actions, signed-in pulls from GitHub Container Registry.

2. Tenant isolation

Every tenant-owned row carries tenantId; every branch-scoped operational row also carries clinicId. Isolation is enforced in two layers that do not replace each other:

  • Application: permission registry with action-key checks (e.g. appointments.create, billing.refund) executed in server actions and API routes.
  • Database: PostgreSQL row-level security policies bound to app.current_tenant_id set inside each transaction, and to request.jwt.claim.tenant_id for PostgREST paths.

3. Encryption

  • In transit: TLS 1.2+ everywhere; HSTS on the public domain.
  • At rest: AES-256 via Azure Storage and Supabase managed storage. Secrets stored in Azure App Settings / GitHub Actions secrets.
  • Passwords: hashed by Supabase Auth (bcrypt). Never logged.

4. Access control

  • Least-privilege roles for engineering and support.
  • SSO + 2FA on Azure, GitHub, Supabase admin consoles.
  • All production-data access by humans is logged.
  • Customer accounts use Supabase Auth; sessions managed by @supabase/ssr.

5. Auditability

Mutating actions inside Vetra emit audit-log rows scoped to the active tenant. Clinic admins can review them at /audit.

6. Backups & recovery

  • Supabase automated backups with point-in-time recovery (subject to plan retention).
  • Container image immutability via SHA-tagged builds.

7. Vulnerability disclosure

Report suspected vulnerabilities to security@proxie.in. Please include reproduction steps and the impact you observed. We acknowledge within 72 hours and aim to triage within 7 working days. We do not currently offer a paid bounty programme. We commit not to pursue legal action against good-faith security research that follows responsible disclosure norms and does not access or exfiltrate Customer Data beyond what is necessary to demonstrate the issue.

8. Sub-processors

The current list is published in the Privacy Policy. Customers are notified of material changes at least 30 days in advance.

9. Incident response

Affected customers are notified without undue delay of confirmed personal-data breaches, and in any event within the timeline required by the DPDPA and any applicable contractual SLAs.