Trust & security

How Vekrin keeps household data private — written for customers, brokers and partners.

Last updated 2026-09-02 · version 2026-09-02.1

Vekrin holds photographs of people's homes, their receipts and their insurance details. That only works if the security model is genuinely sound and honestly described. Below is what is true today, without marketing language.

Household isolation

Every record belongs to a household. Access rules are enforced in the database itself, per row, so a request can only ever return rows belonging to a household the signed-in person is a member of. The application cannot opt out of those rules.

Accounts and roles

Sign-in is handled by a managed authentication provider, with email and password, Google, or Login with Amazon. Provider sign-ins are matched on the provider's own account identifier rather than an email address, use PKCE with single-use state, and store any authorisation encrypted on the server. Households have owner, adult and viewer roles, and invitations are single-use, time-limited and stored only as a hash. Server-side operations re-check permission on every call rather than trusting the browser.

Files

Photographs and documents are held in private storage — never in a public bucket. Files are served through short-lived signed links generated for the person requesting them, and deleting a record removes its files, with a background job confirming cleanup.

Financial privacy

A household can be configured to hide prices and spending from members who do not need to see them, and that restriction is applied server-side, not by hiding it in the interface.

Mailbox access is minimal

Gmail connection is optional and requests read-only access only. Vekrin cannot send, change or delete a message. Only messages that look like invoices or receipts are imported, and disconnecting revokes access immediately.

AI handling

Content sent for extraction or to the Assistant is used to produce your result and returned to your household. It is not used for advertising and not used by Vekrin to train models. The Assistant answers only from the household of the person asking.

Analytics privacy

Usage analytics accept a fixed allowlist of event names and enumerated values; free text is rejected. Session-level rows are aggregated into non-identifying daily statistics and then deleted, targeting 7 days. Administrators see aggregate product metrics, not individual browsing histories, and analytics can be switched off by any user.

Your controls

Export your household data at any time.
Turn usage analytics off in Settings → Legal & privacy.
Disconnect a mailbox in one click.
Delete your account, and its data, yourself.

What we do not claim

Vekrin is not certified under ISO 27001 or SOC 2, is not insurer-certified, and we do not describe it as bank-grade, military-grade or unhackable. No online service is risk-free. If that changes, this page will say so and name the certification.

Reporting a vulnerability

If you believe you have found a security issue, email support@vekrin.app with the details and we will respond. Please do not access other people's data while testing.