Security and data handling
C4.vet Pro is built to need as little of your data as possible.
- No inventories, no agents. It never asks for device lists, credentials to your systems or agents on your machines. Inventory imports are read in your browser; only the matched technology names and versions are saved.
- Sign-in. One-time emailed links (15 minutes, single use, opened through a confirmation page so mail scanners can't use them) or Microsoft and Google sign-in with your organization's own policies and MFA. No passwords are stored. Sessions are random tokens in secure, HttpOnly cookies, and only their SHA-256 is kept.
- Roles. Owners manage alerts, the team, branding and the account; members manage environments and work items; viewers can only read. Every change is in the organization's activity log.
- Secrets. Jira and ServiceNow logins are sealed with AES-GCM before they're stored, and webhook addresses are never shown back in full.
- Sharing. Briefing links are read-only, expire after at most 90 days and can be withdrawn. Calendar links can be reset.
- Hosting. The app and its database run on Cloudflare (Workers and D1) in the United States, over HTTPS only, with a strict content security policy and no third-party scripts, trackers or analytics.
- Deleting. An owner can delete the organization and everything in it from Settings at any time.
Found a security problem? Contact your C4.vet Pro contact.