Security Overview
Vireki is desktop and self-hosted software. It runs on infrastructure you control, so your operational data never needs to leave your environment. Our security program focuses on keeping the software itself trustworthy: how it is designed, built, signed, distributed and patched.
Architecture & Data Handling
What stays local
- All application data, configuration, credentials and connection details.
- Logs and diagnostics, unless you choose to send them to support.
What goes to the license server
Activation and periodic validation contact license.vireki.org over TLS. Only the data needed to verify a license is sent: the license key, a non-reversible machine identifier, the product version and the activation timestamp. No application content is transmitted.
Offline activation is available for air-gapped environments on request.
Secure Development
- Documented SDLC with security requirements considered at design time.
- Mandatory peer code review for every change to the main branch; protected branches.
- Static analysis (SAST) and secret scanning in CI.
- Automated dependency scanning with tracked remediation of known vulnerabilities.
- Least-privilege access to source code and build systems, with MFA enforced.
Software Supply Chain
- Signed builds: release binaries are code-signed (and notarized where the platform requires it); checksums are published with each release.
- SBOM: a software bill of materials is produced for each release and available on request.
- Reproducibility: releases are built in CI from tagged sources with pinned dependencies; we are working toward fully reproducible builds.
- Provenance: build provenance attestations aligned with SLSA are on our roadmap.
Vulnerability Management
We welcome responsible disclosure. Report suspected vulnerabilities to security@vireki.com. Contact details are also published in /.well-known/security.txt. Please give us reasonable time to fix an issue before public disclosure; we will not pursue good-faith researchers.
Target remediation timelines after triage:
- Critical: patch or mitigation within 7 days
- High: within 30 days
- Medium: within 90 days
- Low: next scheduled release
Security fixes are announced in the changelog.
Incident Management
We maintain an incident response process covering detection, triage, containment, remediation and post-incident review. If an incident affects customers, we notify them without undue delay, and within the timelines required by applicable law and our DPA.
Business Continuity
Because Vireki runs on your infrastructure, an outage on our side does not stop the software you already run. Licenses tolerate temporary unavailability of the license server through a grace period. Source code and release artifacts are backed up to separate locations.
Compliance
- GDPR: we process minimal personal data (for licensing and billing) and offer a Data Processing Agreement. See our subprocessors.
- SOC 2 Type II: planned. Not currently certified.
- ISO/IEC 27001: planned. Not currently certified.
Need more detail? Request our security questionnaire.