Security

Addresses

A delivery address is the most sensitive thing we hold, so it is locked away from the moment it is typed. It is encrypted with a key that is kept outside our database, and only the people arranging that one delivery can unlock it, with every look recorded. The sender never sees it, and it is deleted within 30 days of delivery.

Payments

Card details are entered with Stripe, our payment provider, and never reach our servers. We keep only what we need to show you which card you used and to issue a refund.

Your account

There are no passwords to steal. Every sign-in is a six-digit code sent to your email, and it only works for a few minutes. Our own team signs in with a second step on top of their password.

Our website

Every page is sent over an encrypted connection and with rules that stop other websites from running code on it or showing it inside their own pages.

Reporting a security problem

If you think you have found a security problem in Vela, please tell us through our support page and say it is about security. Please do not look at, change or keep anyone else’s information while you check, and give us a fair chance to fix it before you tell anyone else.