Vemio
Security & Providers
A transparent overview of the controls and integration inventory being verified for Vemio pilots.
Current release stage
Vemio is being prepared for controlled pilots. This page does not claim completed penetration testing, SOC 2 certification, HIPAA compliance or a security guarantee. Known database permission gaps and release checks must be resolved before sensitive customer data is onboarded.
Access boundaries
Client data should be limited to the owning company and authorized employees. Supabase grants and Row Level Security protect direct database access; server routes using elevated credentials must separately check authentication, membership and permissions. These controls require testing with different companies and roles.
Provider inventory
The current code integrates Vercel for hosting, Supabase for authentication and database services, Stripe for subscriptions, Telnyx for voice and WhatsApp, Resend for email, and OpenAI for configured AI features. A Telnyx assistant may use an additional configured model provider. Legacy Google integrations must be checked for active data use. This is an integration inventory, not a finalized contractual subprocessor list.
Data location and lifecycle
Hosting regions, provider retention, recordings, backups and deletion procedures must be confirmed for the production configuration. Do not infer them from a provider logo or a feature description.
Reporting a concern
Use the contact options below or the client portal Support page. Do not send passwords, payment details, secret keys or full customer records in a report. Describe the affected workflow and a minimal example.
Procurement questions
Contact us about security questionnaires and data-processing terms. No DPA availability or negotiated security commitment is asserted by this page.