Security and Service Providers

How we protect your data, who helps us run MyVendbook, and how to report a problem. Effective October 16, 2026.

Security

How we protect your data and how to report a problem.

Encryption in transit; passwords are salted and hashed.
Per-user access controls, rate limits and activity logging.
Team logins: what each role can see and change is enforced on our servers, not just hidden on screen. Invite links work once, expire after 7 days and are stored only as a one-way hash. Removing a teammate signs them out immediately.
Only the facts you choose to share are ever shown to other members.
Report a vulnerability to [email protected]. We will acknowledge within 3 business days and will not take action against good-faith research.

Who processes data on our behalf.

We use the following providers to run MyVendbook.

Anthropic, for Vendy AI answers and web search.
Your browser maker's speech-recognition service (Google, Microsoft or Apple), only if you choose to speak to Vendy AI. It is run by the browser maker, not by MyVendbook.
Render, to host the app and store your data.
Cloudflare, to host this website and protect it from abuse.
An email delivery provider, to send account and service email.
A text message provider, to deliver texts if you opt in to them.
Stripe, to process payments and subscriptions. We do not store full card numbers.

We require providers to protect your data and use it only to provide their service to us.