Security

Infrastructure

Our web products run on managed cloud infrastructure in the United States and the European Union. We do not operate our own data centers. Production systems are accessed only by named engineers, with multi-factor authentication required on every account.

Encryption

• All traffic to our websites and apps uses TLS 1.2 or later. HTTP requests are redirected to HTTPS.
• Customer data is encrypted at rest with AES-256 by our database and storage providers.
• Passwords are hashed with bcrypt. We never store them in plain text.

Payments

Card payments are handled entirely by our payment provider, which is PCI DSS Level 1 certified. Card numbers go straight from your browser to the provider and never touch our servers. We only see the card brand, the last four digits and the expiry date.

Access and permissions

• Staff access to customer data is limited to support cases you raise, and every access is logged.
• Workspaces support role-based permissions. Business and Pro plans add SSO and audit logs.
• Former staff lose access to all systems on their last working day.

Backups and availability

Databases are backed up continuously with point-in-time recovery for 14 days. Backups are encrypted and stored in a separate region. We test a restore every quarter.

Vireo Player

Vireo runs entirely on your computer. Your media files never leave your device. The app contacts our servers only to activate a license and, if you enable it, to check for updates. Release builds are code-signed on Windows and macOS.

Reporting a vulnerability

If you think you've found a security issue in any TechGlobe product, email security@techglobellc.com with the steps to reproduce it. We acknowledge reports within 2 business days and keep you updated until the issue is fixed. Please don't access other customers' data, run denial-of-service tests, or publish details before we've had a reasonable chance to fix the issue. We won't take legal action against good-faith research that follows these rules.