Conpass
Get early access

Security

The short version: Conpass is built to hold as little sensitive data as possible: no platform passwords, no attendee data. What we do hold is encrypted in transit, access-controlled and kept only as long as needed. Report vulnerabilities to our security team; we will not pursue good-faith research.

Effective 7 October 2026 · Verne Ltd.

Secure by design

  • No credentials for third-party platforms are ever stored or requested.
  • Secrets live in environment configuration, never in source code.
  • All traffic uses TLS. Databases and object storage are never exposed to the internet.
  • The browser extension only reads the active tab after you click, with no background access.
  • Capture uses scoped, high-entropy tokens separate from your sign-in.
  • Nothing produced by automated reading reaches your radar without validation.

Operations

Conpass is in early access. Our deployment runbook requires:

  • Least-privilege access for staff and services.
  • Nightly database backups, encrypted before they leave the server and copied off the main host, with a monthly restore drill.
  • Raw page snapshots and captures expire after 180 days.
  • Audit-relevant records such as event sightings and scores are append-only.
  • Dependencies are pinned and checked in continuous integration.

Reporting a vulnerability

Email security@vernesystems.com with steps to reproduce. We acknowledge reports within three working days and keep you updated until a fix ships. Our security.txt has the same details.

We will not take legal action against good-faith research that avoids privacy violations, data destruction and service disruption, and gives us reasonable time to fix issues before disclosure.