Security and Trust
This page states only controls verified for the public website candidate. It does not claim a certification, audit, service-level commitment, or product-wide guarantee.
Public website controls
- Static pages on Cloudflare Pages with no login, checkout, analytics, advertising tracker, or cookies or browser storage of the website's own.
- The invitation form sends your request over HTTPS to a Cloudflare Pages Function, which checks it and stores it in a private Cloudflare D1 database. The privacy notice on the invitation page lists what is stored. Stored requests are not shown on any public page or public interface.
- A restrictive Content Security Policy that blocks inline code, framing, and plugins and limits connections and form posts to this website. It allows scripts from this website and from challenges.cloudflare.com, and framed content only from challenges.cloudflare.com, for the optional Cloudflare Turnstile security check on the invitation form.
- Form protections: a size limit, checks on allowed values, a hidden trap field, a minimum time on the page, answers that do not reveal whether an email address is already listed, error messages that do not repeat what you entered, form code that does not write your answers to logs, and the optional Turnstile check.
- HTTPS preparation, transport-security headers, referrer controls, content-type protection, and restricted browser permissions.
- The invitation page warns against sending secrets or sensitive data.
- Account and billing links fail closed until approved Platform destinations are configured.
Product boundaries
Each Virtuad application has separate account, privacy, data-processing, availability, and security requirements. Public website controls do not prove that an application or third-party provider has the same architecture.
Report a security concern
Email support@virtuad.ai with a clear description and safe reproduction details. Do not send live credentials, private keys, payment-card data, or unnecessary personal data.