Security

Last updated 2026-09-12

This page is not finished. 2 decisions still unmade: security.encryptionAtRest, security.backupsFrequency. Set them in content/legal.json and re-run npm run gen:legal, then have a lawyer read the result before this page is public.

Every sentence on this page is one a customer can check. That is the point of it, and it is why nothing appears here that is not true today.

In transit

All traffic is served over HTTPS, with HTTP redirected. Certificates are issued and renewed automatically.

At rest

unverified — REVIEW — true only once the database provider's at-rest encryption has actually been confirmed in the dashboard

Access

Accounts are held by licence key. There are no passwords to reuse or leak, and no password reset flow to phish. The trade-off is that anyone holding the key has access, so treat it like one.

Backups

security.backupsFrequency — not set

Payment data

We never receive your card number. Stripe processes payments and is PCI DSS Level 1 certified.

Reporting something

If you find a vulnerability, tell us at [email protected]. We will acknowledge it, and we will not pursue anyone who reports in good faith and does not access other people's data.

Le Visage Refinery is operated by Le Visage Refinery LLC. Questions about this page: [email protected].