Security
Last updated: July 30, 2026
RPMVault treats security as a core product responsibility. This page explains how we protect accounts and data, and how to report vulnerabilities responsibly.
1. Security practices
We use industry-standard controls appropriate for a SaaS product of our size and risk profile.
- Encrypted transport (TLS) for all production traffic
- Firebase Authentication for identity, with session and token controls
- Least-privilege access to production systems and secrets
- Rate limiting on sensitive endpoints such as account deletion and data export
- Monitoring and error reporting with PII scrubbing where feasible
- Dependency and infrastructure updates on a regular cadence
2. Data protection
Personal data is processed as described in our Privacy Policy. Payment card data is handled by licensed payment processors and app stores; RPMVault does not store full card numbers.
You can export or delete your account data from Profile while signed in. Public instructions are also available on the Account Deletion page.
3. Responsible disclosure
If you believe you have found a security vulnerability in RPMVault, please report it privately so we can investigate and remediate before public disclosure.
- Email: security@rpm-vault.com
- Include steps to reproduce, affected URLs or endpoints, and impact assessment
- Do not access, modify, or destroy data that is not yours
- Do not perform denial-of-service, social engineering, or physical attacks
- Allow a reasonable time for remediation before public disclosure
We aim to acknowledge valid reports within 3 business days and keep reporters informed of progress.
4. Out of scope
Reports limited to missing security headers without demonstrated impact, theoretical issues without a proof of concept, or vulnerabilities in third-party services outside our control are generally out of scope.
5. security.txt
Machine-readable contact details are published at https://rpm-vault.com/.well-known/security.txt.