Security at Vinconex
Last updated June 2026
Vinconex is built and operated by CraveBeast LLC with the SOC 2 Trust Services Criteria (security, availability, confidentiality, privacy) as the design baseline. A formal SOC 2 examination has not yet been completed; the controls below are live in the product today and produce their own evidence.
- 01
Access control
Role-based access (dealer admin, manager, Vinconex staff) with tenant isolation — every dashboard query is scoped to one dealership. Vinconex platform accounts must pass an emailed one-time code on every sign-in; dealers can require it per user and set how long a device is trusted. Brute-force lockout after repeated failures.
- 02
Passwords and sessions
Passwords are hashed with bcrypt. New passwords must be 12+ characters and are screened against known breach corpuses (k-anonymity lookup — the password never leaves our server) and against your recent passwords. Sessions are server-side and can be revoked individually or all at once (“Sign out everywhere”); they end after 12 hours idle for dealer users (dealer-adjustable) and 2 hours for platform accounts. Disabling a user or resetting a password ends their sessions immediately.
- 03
Audit logging
Sign-ins (successful and failed), MFA events, password changes, team changes, settings changes, lead status changes, data purges and every platform-staff action are recorded with actor, IP address and device in an append-only log. Each entry is hash-chained to the previous one so edits or deletions are detectable; Vinconex staff can verify the chain on demand. Retained 13 months.
- 04
Encryption
All traffic is encrypted in transit with TLS. Uploaded documents live in private object storage and are streamed through Vinconex only after authorisation; storage paths are never exposed. Backups are compressed snapshots stored in private object storage with a SHA-256 checksum.
- 05
Backups and restore drills
A full snapshot of every collection is taken nightly. Vinconex staff run restore drills that download a backup, verify its checksum and recount every collection against what was recorded; results are logged. Backups are kept 30 days.
- 06
Vulnerability management
Backend (pip-audit) and frontend (yarn audit) dependencies are scanned weekly against public vulnerability databases and on demand; findings are reviewed by CraveBeast LLC and tracked in the security review log alongside external tests.
- 07
Monitoring and alerting
Failed sign-in and server-error rates are evaluated every 15 minutes; spikes alert the platform owner. Platform sign-ins from a network not seen in 90 days trigger an alert email to the account.
- 08
Data retention and deletion
Shopper contact details are purged from leads after 24 months by default (each dealership can choose 6 months to 5 years or keep indefinitely). Dealer admins can purge a shopper's data on request in one click. Contact-form messages lose sender details after 24 months.
- 09
Access reviews
Every quarter each dealership's admins receive a list of everyone who can sign in, with logins unused for 90+ days flagged, so access can be revoked deliberately — nothing is disabled automatically.
- 10
Reporting a vulnerability
Found something? Email contact@vinconex.com with the details. We acknowledge reports within two business days and won't take legal action against good-faith research that respects users' data.