OPERATIONSPRO
Accountability. Clarity. Results.
Security & Trust
Vector apps · Last updated 2 October 2026
This page is for the IT and security teams who review Vector before their organization uses it. It says plainly where your data lives, who can see it, which companies process it for us, and what we commit to. Everything here describes how Vector works today. Anything still being built is marked Coming. If your review has a questionnaire, send it to support@vectorxpro.com and we will fill it in.
The company
| Legal name | VectorXPro LLC |
|---|---|
| Formed | Kansas limited liability company, 2026 |
| Location | Salina, Kansas, United States |
| Signatory | Craig Reed, owner |
| Service type | Software as a service: an iPhone app and a website, run on hosted infrastructure |
| Contact | support@vectorxpro.com |
Quick answers
| Data location | United States (AWS us-east-1, Northern Virginia, through Supabase) |
|---|---|
| Personal information | Limited to business contact details: name, work email, job title, role. No home addresses, government IDs, HR, health or payroll data. |
| Financial information | None. Subscriptions are billed by Stripe; card numbers never reach Vector. |
| Confidential business information | Yes, what your organization records: findings, notes, photographs of the plant floor, and site or area plans. Classify it as internal/confidential. |
| Integration with your systems | None required. Vector does not connect to your network, ERP or file shares. Optional: company sign-in (SAML SSO) through your own identity provider. |
| If Vector is unavailable | Not production-critical. Work in progress waits; nothing recorded is lost. Evidence packs can be printed or saved at any time as an offline copy. |
| Advertising, tracking, data sales | None. No ads, no analytics or tracking tools in the app or on this website, and no information sold. |
| AI | Your records are not sent to any AI service and are not used to train AI models. |
Where your data lives
Supabase runs Vector's database, sign-in and file storage on Amazon Web Services in the United States (us-east-1). Supabase operates a SOC 2 compliant environment and encrypts data at rest. The website you are reading is served by Microsoft Azure Static Web Apps; it holds pages only, never customer records.
Encryption
- In transit: every connection from the app and the website uses HTTPS (TLS).
- At rest: the database and stored files are encrypted by our hosting provider.
Who can see what
- Each organization is separated in the database itself, not just in the app. Every table in Vector's database has row-level security switched on, so the database refuses to return another organization's rows no matter what is asked of it.
- Nothing is public. A visitor who is not signed in can reach no records. Every file storage area (photographs, plans, logos) is private, and photographs are shown only to signed-in people in the same organization.
- Roles inside your organization decide who can invite people, run audits, close items and see which sites. Your Organization Admin controls them.
- Outside contractors can be named as the owner of an item without being given access to the rest of your records.
A record that can't be quietly changed
Every change to an item, note, photo, walk or finding adds an entry to your organization's record, and each entry carries a fingerprint (SHA-256) of itself and of the entry before it. Changing anything afterwards breaks every fingerprint that follows. Photographs are fingerprinted on the phone before they are sent. An independent timestamp authority (DigiCert) signs the newest fingerprint at least daily, and within a minute of a walk being submitted or an item closed. The authority receives the fingerprint only, never the content. Admins can run a full Record Check in the app at any time. How the record works.
Signing in
- Passwords: email and password through Supabase Auth; passwords found in known data breaches are refused. People join only by invitation from their organization; invitation links and codes work once.
- Company sign-in (SSO): SAML 2.0 with Microsoft Entra ID, Okta, Google Workspace or another SAML provider. Your identity provider decides who can sign in, enforces your own password and two-step rules, and ends access when you remove someone: they are refused at their next sign-in. An invitation is still required, so being in your directory alone does not get anyone into your records. Contractors outside your directory keep email sign-in. Setup takes your IT team about ten minutes; we send the steps.
- Two-step verification: a 6-digit code from an Authenticator app (Microsoft, Google or any standard one) after the password. Organization Admins and Site Managers always use it; your admin can require it for everyone who signs in with a password. The database itself enforces it: until the code is entered, that session can see nothing.
Backups and availability
The database is backed up daily by Supabase, and the last seven days of backups are kept. Photographs and files are held in separate private storage, and every night each new one is copied to a private, encrypted backup in VectorXPro's own Microsoft Azure account in the United States, so they can be recovered if the main storage is ever lost. The key that writes the backup can only add files: it cannot read, change or delete them. Vector is built so that ending a subscription never locks you out of your own record: it becomes read-only, and every evidence pack can still be printed.
Companies that process data for us
| Company | What it does | What it receives |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions (US) | Your organization's records and files |
| Resend | Sends Vector's emails (US) | Recipient name and email, and the email's content |
| Stripe | Subscription billing (US) | The billing contact and card details, entered on Stripe's own page |
| Apple | App distribution; Maps looks up a site address | A site's address when it is shown on a map |
| DigiCert, FreeTSA | Independent timestamps | A fingerprint (hash) only, never content |
| Microsoft Azure | Hosts this website; keeps the nightly backup of photos and files (US) | An encrypted copy of your organization's photos and files, for recovery only |
If something goes wrong
If we learn that someone has gained access to your organization's data without authorization, we will tell your Organization Admins without undue delay, and within 72 hours of confirming it: what happened, what data was involved, and what we are doing about it. To report a security concern, write to support@vectorxpro.com with "Security" in the subject line.
Leaving Vector
Any person can delete their own account in the app. When an organization closes its account, its records and files are deleted, so save anything you need first: evidence packs print or save as PDFs. The full detail is in the Privacy Policy.
What we are honest about
VectorXPro LLC is a small company. We do not yet have a SOC 2 report of our own; our hosting provider operates a SOC 2 compliant environment, and we answer your questionnaire specifically rather than with badges. Our Terms of Service and Data Processing Agreement are published as drafts; ask us for the current versions.
Contact
VectorXPro LLC · Salina, Kansas · support@vectorxpro.com