Security overview
Last updated October 13, 2026
Architecture
Vordence uses authenticated workspace boundaries, server-side authorization, hashed API keys, encrypted optional connector credentials, bounded request bodies and rate-limited runtime endpoints.
Client decisions
Review links expire, become unusable after a decision and can require a matching signed-in invited reviewer. Agencies may require up to three distinct release-bound client sign-offs.
Runtime enforcement
Actions may be observed, authorized, held for exact-action review, or blocked before execution. One-shot execution authorization and the resulting external effect are recorded separately.
Delivery security
Outbound webhooks are HTTPS-only, signed, retried with backoff and moved to a visible dead-letter state. Email is sent only when a provider is configured.
Evidence and recovery
Permit, release, action and evidence-chain fingerprints make silent changes detectable. Hosted-provider recovery remains an operational responsibility, not an implied certification.
Responsible disclosure
Report a suspected vulnerability to the support contact shown by your Vordence provider. Do not include production secrets in the initial report.
Limitations
This page is a product security overview, not a certification, penetration-test report or warranty.
Before public commercial launch, counsel should review entity-specific terms, jurisdiction, support contact, subprocessor list and regulatory commitments.