Security Overview
Voroa runs your applications, databases and backups. This page explains, in plain terms, how we keep them safe. For the legal commitments, see our Data Processing Agreement and Privacy Policy.
No credit card required.
Your data stays in India
Your services, databases and backups are hosted in India. Backup copies are stored in India too, in Mumbai.
Your service and build logs, and files in Voroa Object Storage, are stored in the Asia-Pacific region on a best-effort basis. A few providers, such as email delivery, may handle limited data outside India. We name each of them in our Privacy Policy, so you always know who they are.
For an Indian business, this keeps your customer data inside the country and close to the people who use your app.
Encrypted in transit and at rest
Every Voroa dashboard, API and service address is served over HTTPS.
Your environment variables and secret files are encrypted with AES-256-GCM before they are stored. Once saved, a secret value can be replaced but never shown again - not to you, and not to our staff.
Database passwords are stored encrypted. You can reveal your own, only while signed in, and every reveal is logged and rate-limited. Backups are encrypted at rest.
In practice this means you can paste a production API key into Voroa without worrying that it will show up later on a screen share, in a screenshot or in a support conversation. If you lose a value, you replace it - you never read it back.
Every customer kept apart
Every request is checked against the workspace it belongs to. One customer can never read, change or deploy another customer's service, database or settings.
Each service runs in its own container with its own CPU and memory limits.
Builds that need extra capacity run on short-lived machines in India that are destroyed after use, and each build's working files are deleted when that build ends.
Strong sign-in and team roles
Passwords are stored only as one-way hashes (bcrypt), never in readable form.
You can sign in with email and password, a one-time email code, GitHub or Google. Two-factor authentication with an authenticator app is available for every account.
Team members get roles, so you decide who in your workspace can change what.
Turn on two-factor for every person who can deploy. A stolen password alone is then not enough to get into your workspace. When someone leaves your team, remove them from the workspace and their access ends at once.
A protected network
Our main servers talk to each other over a private, encrypted network. Anything else that leaves our servers, such as backups, travels encrypted.
DDoS protection sits in front of the Voroa dashboard, API and website, and is on by default for your services where it applies. Paid plans can also turn it on for custom domains.
Access to production servers is limited to authorised personnel using individual keys.
Daily backups, tested restores
Managed databases are backed up every day and kept for 7 days.
Voroa's own platform data is backed up every day, encrypted, to a separate location.
We test restores from real backups, not just that backups are written. A backup you cannot restore is not a backup.
You can also take a backup of a managed database yourself whenever you want, download it, or restore an earlier one - for example before a risky migration.
Automatic monitoring and alerts
We monitor our servers, services and certificates with automatic alerts.
If a security incident affects your data, we tell you without undue delay, and we report to CERT-In where Indian law requires it. The exact timeline is in our Data Processing Agreement.
Compliance, stated plainly
We follow the Digital Personal Data Protection Act, 2023. Our Grievance Officer handles data requests at legal@getvoroa.com.
We do not hold ISO 27001 or SOC 2 certification today. We say so here rather than leave you to find out later.
Your part of keeping things safe
Voroa secures the platform: the servers, the network, the encryption and the separation between customers. What runs inside your service is yours to secure.
That means keeping your dependencies up to date, never committing secrets to your repository, and putting API keys and passwords in environment variables instead. It means checking who in your team really needs deploy access, and turning on two-factor for them.
If your app stores user data, protect it the way you would anywhere else: validate input, hash passwords, and give your database user only the access it needs. Voroa gives you the tools; how you use them decides the rest.
Found a security issue?
Email legal@getvoroa.com with what you found and how to reproduce it.
Please give us a fair chance to fix it before you share it publicly.
Build on a platform that takes security seriously
Start free. Your data stays in India from the first deploy.
No credit card required.