24.9°N · 121.3°ESecurity & trust
Security you can check, not just read.
What we do today, who is responsible for what, and what we don't claim. Written for the person who has to approve a vendor.
- HTTPS only
- No ad or analytics trackers
- Public form is write-only
- No public admin panel
How we build
Least privilege
Every account, key and tool gets only the access its job needs, and nothing stays open by default.
Your data stays yours
It belongs to you. Export it or ask us to delete it at any time. We don't use it to train AI models.
No secrets in code
Keys and passwords live in managed environment settings, never in source repositories or screenshots.
Small attack surface
Public pages are static, there is no public admin panel, and there are no third-party advertising or analytics scripts.
Humans approve risky steps
In AI and automation work, anything high-risk waits for a person's confirmation, and what the system does is recorded.
Honest limits
We don't promise 100% security. We promise to bring known risks down to a manageable level and to tell you plainly when something goes wrong.
Who is responsible for what
Security is shared. Writing it down early avoids surprises.
You
- Decide who may access your systems, and revoke access when people leave
- Keep your own account credentials safe
- Handle your customers' personal data under your industry's rules
- Review the delivery during the 30-day acceptance period
Vanture
- Build with least privilege and keep secrets out of code
- Connect remotely only in agreed windows, then revoke access
- Keep dependencies on supported, patched versions
- Take and verify backups; tell you promptly if an incident affects your data
Cloud providers
- Physical and infrastructure security
- Encryption in transit and at rest, as their managed services provide it
- Platform availability
This website, as an example
Everything here can be checked from a browser.
HTTPS everywhere
Connections are encrypted, and browsers are told to use HTTPS only (HSTS).
Browser protections
A restrictive content security policy, no framing, no content-type sniffing, a strict referrer policy, and camera, microphone and location access switched off.
No tracking
No analytics or advertising scripts. The only cookie is your language preference.
A form that can only write
The contact form can add an enquiry but cannot read any. It has a hidden-field trap, a speed check, rate limiting and server-side validation.
No public admin panel
There is no login page to attack: content lives in our repository and is published by a build, not edited through a web console.
Current software
We check production dependencies against the public advisory database and update them when a fix exists.
A way to report problems
A security.txt file tells researchers how to reach us.
Check it yourself
shellcurl -sI https://getvanture.com/en | grep -iE "strict-transport|content-security|x-frame|x-content-type|referrer-policy|permissions-policy"
curl -s https://getvanture.com/.well-known/security.txtThese commands show the headers your browser receives, and our security contact file.
Remote delivery, with guardrails
Most projects are delivered without a site visit. This is how access works.
- 1
Scope
We write down what we need to reach, and why.
- 2
You grant access
Through your own remote-desktop tool, on your terms.
- 3
A fixed window
We connect only at the agreed time, and you can watch the screen.
- 4
Access ends
Permissions are revoked when we finish. No standing remote channel.
- 5
Written handover
What was installed, where, and who holds which credentials.
We never take custody of online-banking, payment or financial credentials.
When AI is involved
Rules we apply to AI features and agents.
Your data, your boundary
AI features work only inside your own data. Which data goes to which model is written down before we start.
Least-privilege agents
An agent gets only the access its task needs.
Reviewed add-ons only
We use reviewed skills, not community plug-ins installed casually, and we record every change.
People stay in charge
Customer-facing AI says it is AI, and important decisions are confirmed by a person.
Your data and the contact form
What we collect here
Only what you type into the contact form (name, email, optional phone and LINE, your message) plus basic server logs for security.
How long we keep it
Enquiries are deleted 12 months after our last contact. If we work together, records follow the contract and the law.
Your rights
You can ask to see, correct or delete your data under Taiwan's Personal Data Protection Act.
If something goes wrong
If an incident affects your data, we tell you as soon as we know, say what is known, and help contain it.
What we don't have
Stated up front, so nobody finds out later.
- No third-party certification today (for example ISO/IEC 27001 or SOC 2).
- No independent penetration-test report to share.
- We are a two-person studio. If your requirements need a large dedicated security team, tell us early and we will say plainly whether we fit.
We do answer vendor security questionnaires, and we tell you where the answer is no.
- 1
Email the address below with what you found and how to reproduce it.
- 2
Good-faith research is welcome. Please don't access, change or keep other people's data.
- 3
We will acknowledge your report and keep you informed.
Sending us a security questionnaire?
Send it with your enquiry. We answer what is true, and say plainly where the answer is no.
Last reviewed: 7 November 2026