อ่านเว็บไซต์นี้เป็นภาษาไทย
Language ไทย
Book a demo Start a project

Security

Less data, held carefully.

We build software that sits close to clinics and the people they care for. This page explains, in plain language, how we handle the data that passes through our work, and how to tell us if you find a weakness.

We hold no security certifications today. What follows is how we actually work, not a badge.

Report a vulnerability

How we work

Six security practices.

  1. Collect less

    Every system starts by asking which data it truly needs. Our own website keeps no database of contact submissions: a message becomes an email and nothing more. In systems we build, retention is decided before launch, not after.

  2. Encrypted on the wire

    Every connection to our sites and to the systems we build uses HTTPS (TLS), with HSTS so browsers never fall back to plain HTTP. Data held by our cloud providers is encrypted at rest by those providers.

  3. Only the people who need it

    On the custom systems we build, access is personal, never shared, and limited to the people working on that system. Accounts use multi-factor authentication. When the work ends, the access ends.

  4. Secrets stay out of code

    API keys and credentials live in the platform secret store, never in source code, chat or email. We rotate them when people or vendors change, and the rotation steps are written down.

  5. Logs without the content

    Our logs record that something happened, not what someone said. Message bodies, contact details and patient information stay out of logs and error reports. Where a product keeps conversation records for the clinic, those records live in an access-controlled database we operate on the clinic’s behalf, separate from logs, under the retention the clinic agrees.

  6. Few vendors, chosen on purpose

    We prefer a small number of established providers with published security programs and data processing terms, and we name every one a system uses before it goes live. We do not use client data to train AI models.

PDPA

Built around Thailand’s Personal Data Protection Act.

Every field we collect has a purpose, a lawful basis and a retention limit, and every system has a way to answer a data subject request.

On this website

We are the data controller.

When you contact us, VESPERWERK Co., Ltd. decides how that data is used. Our privacy notice explains exactly what we collect and for how long.

Read the privacy notice

In systems we build for you

You are the data controller.

Your clinic or business decides why patient and customer data is processed. We act as your processor under a written agreement, follow your instructions, and help you meet your obligations.

Handover

At handover, you hold the keys.

Custom systems are built to be owned by you. When a project is handed over, this is what you have.

  • The source code and its full history, in a repository under your account.
  • Cloud accounts, domains and API keys registered to you, with billing in your name.
  • Your data in open formats, plus the scripts that export it.
  • Documentation: architecture, runbooks, and how to rotate every secret.
  • Our access removed on the date you choose, confirmed in writing.

Responsible disclosure

Found a weakness? Tell us.

If you believe you have found a security issue in our website or in a system we operate, please report it privately. We would much rather hear it from you.

What to include

  • The affected URL, system or component
  • Steps to reproduce, with requests or screenshots
  • The impact you believe it has
  • How we can reach you, and whether you would like credit

What happens next

  1. We acknowledge your report within 5 business days.
  2. We keep you updated while we investigate and fix it.
  3. We tell you when it is resolved and, with your permission, credit you.

We do not run a paid bug bounty.

Safe harbor

If you act in good faith under this policy, we will not take legal action against you or report you to the authorities for your research. Good faith means you avoid privacy violations, data destruction and service disruption; you access only the minimum data needed to show the issue and stop as soon as you reach personal data; and you give us reasonable time to fix it before any public disclosure.

Out of scope

  • Denial of service, load or stress testing
  • Social engineering or phishing aimed at Vesperwerk or our clients
  • Physical attacks on offices or devices
  • Automated scanner output without a demonstrated issue
  • Missing headers or email settings without a working exploit
  • Clickjacking on pages with no sensitive action
  • Services run by our vendors: report those to the vendor
  • Systems owned by our clients: report those to the client

Questions about security in a project?

Ask us before you sign anything. We will walk you through how a system handles your data.

Contact us