What this page sends

Content-Security-Policy: default-src 'none'

Nothing loads by default; every kind of resource has to be explicitly allowed, and there is no script-src at all. That is a stronger statement than "no inline scripts" — it means no JavaScript runs on this page, permitted or not.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Two years, every subdomain, and submitted to browsers' built-in preload list — a browser refuses to even attempt an insecure connection here, rather than upgrading one after the fact.

Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=(), usb=()

This page cannot ask for your location, microphone, camera, a payment sheet or a USB device — blocked at the policy level, on top of the fact that no script runs here to ask in the first place.

Cross-Origin-Opener-Policy: same-origin

This tab cannot be reached or scripted from another origin's window handle.

Referrer-Policy: strict-origin-when-cross-origin

A click to an external site sends that site your domain, not the full page you were on.

X-Content-Type-Options: nosniff

A browser will not guess a file's type from its content and run it as something it was not served as.

What the application sends

This page is a static marketing site holding no customer data. The application at app.venweave.com is where the product actually runs, and it is worth reading these as a separate set of headers rather than borrowing the assurance of the first list.

Content-Security-Policy (app.venweave.com): default-src 'self'; script-src 'self'

No inline script and nothing loaded from another domain. Style-src does permit 'unsafe-inline', a gap this page does not carry. A parallel Report-Only policy is live too, tightening image sources from any HTTPS host down to the one CDN the product actually uses, ahead of that becoming enforced.

Strict-Transport-Security (app.venweave.com): max-age=63072000

Two years, the same duration as this page, though without includeSubDomains or preload.

X-Frame-Options: DENY

The application refuses to render inside a frame on any other site, on top of the same protection already in its Content-Security-Policy.

api.venweave.com carries a shorter HSTS today: max-age=3600

One hour, not two years — a real gap between what the application enforces and what its own API enforces. Named here rather than left for someone to notice in a scan, and not blended into the number above.

What it actually does

A hash-chained audit log

Every sensitive action — pay changes, document sends, permission grants, exports, logins, two-factor changes, payment edits, commission changes, cross-org share activity, even reads of the log itself — writes a record whose hash covers its own fields plus the previous record's hash. Editing or deleting a past entry breaks the chain, and the database itself blocks updates and single-row deletes on this table, not just the interface.

Two-factor authentication your organization can require, not just offer

TOTP-based, and an admin can flip one setting that makes it mandatory. Someone who has not enrolled gets a login that accepts their password and hands back nothing more than an enrollment link — not a working session.

Venue-scoped access, enforced in the query, not the screen

A coordinator scoped to one property cannot read another's events, room layouts, function sheets or timesheets — the filter happens in the database query, not by hiding a button. Compensation is stricter still: pay rate and pay type are stripped from the response for anyone but the employee, their manager or HR, and sorting a list by pay rate is blocked, because a sort order leaks the number without ever displaying it.

What crosses an organization boundary is an allowlist, not a filter

A cross-org share builds its payload by naming what goes in, not by removing what should stay out. Price, cost and discount data are never on that list. The one deliberate exception is quote notes — free text a person typed, which can contain a number — and it defaults off, unlike everything else in the payload, which defaults on.

Tenant isolation, checked by a test that fails the build

There is no single chokepoint that makes cross-tenant access structurally impossible — each endpoint scopes its own queries to the requesting organization. What backs that is a test that runs every registered endpoint as two users in two different organizations and fails the whole suite if either one can see a query bound to the other's data.

Short-lived access, long-lived refresh, both revocable

A session token is good for 15 minutes. A refresh token lasts a week, rotates on every use, and is blacklisted the moment it does — a stolen refresh token is a stolen ticket that gets punched exactly once.

What we do not have

No SOC 2, no ISO 27001, no third-party penetration test

None of the three exists yet, and nothing here claims otherwise. A product with one customer does not have the volume to make a compliance audit worth commissioning before it has a second one.

No continuous audit-chain verification

The chain can be checked end to end — content, links, forks, tampering signatures — and we can run that check on request. It is not scheduled, and it is not something you can trigger yourself yet; today it takes someone with access to VenWeave's own infrastructure.

No self-service two-factor recovery

Losing your authenticator today means asking us to reset it by hand. There are no backup codes.

No blanket rate limit across the API

Login, two-factor and password-change endpoints are throttled specifically. General API traffic is not capped, on purpose — a blanket limit would also throttle a legitimate bulk import or a large report. The throttle counters themselves currently run per-worker rather than on a shared store, so the effective limit on a multi-worker deployment is higher than the stated number.

No database-level encryption-at-rest configuration in this codebase

Two specific secrets — two-factor seeds and connected-account tokens — are encrypted at the field level regardless of anything else. A database-wide at-rest policy is the hosting provider's layer, not application code, and this repository does not configure one itself.

Business-hours support, best effort

No support SLA and no guaranteed response time — consistent with what the homepage already says about support.

Last updated August 9, 2026.