The short version
- Your customers' details and photos are private to your workspace.
- Approval links can't be guessed — and old links die the moment you regenerate one.
- We never see or store card details. Stripe handles all billing.
- Your records are yours: download proof PDFs and your data any time.
The technical detail is below, for anyone who wants it.
What Variation Vault protects
Variation Vault protects job records, customer details, variation details, uploaded photo evidence, approval events, completion proof records, billing metadata, and diagnostic data used to keep the service running.
Core protections
- Supabase authentication for trade user accounts.
- Organisation-scoped access so users work inside their own workspace.
- Row Level Security and server-side checks for application data.
- Customer WhatsApp numbers remain organisation-scoped and are used only for manual approval-link handoff when added.
- Public approval tokens stored as hashes, not raw tokens.
- Private photo storage with short-lived signed media access where needed.
- Proof PDFs generated on demand instead of public proof sharing by default.
- Stripe-hosted billing so card details are not collected by Variation Vault.
- Rate limiting and abuse protection for public links and sensitive actions.
- Sentry privacy scrubbing before error diagnostics are sent.
Public approval links
Customer approval links are public by design, but the raw tokens are not stored. The app stores hashed approval tokens and validates the link before showing customer-facing job, variation, and photo evidence.
There is no public proof sharing by default. Approval proof packs and completion proof PDFs are generated on demand for authorised workspace users.
Billing and monitoring
Subscription checkout and billing management are Stripe-hosted. Variation Vault stores subscription status and Stripe identifiers, but does not collect customer card details.
Sentry is used for error diagnostics with privacy scrubbing. Session replay, tracing, and user feedback widgets are not part of the launch setup. Vercel Analytics is used for page-level product metrics.
Product boundaries
Variation Vault is a record and approval workflow tool. It does not provide legal advice, does not guarantee payment, and does not create invoices or process customer payments inside the app.