Identity
Session-based authentication, strong password requirements, protected recovery, and role-scoped access.
Trust center
Security designed into the operating path.
VialAPI uses layered identity, authorization, data, integration, and operational controls. This overview describes the controls customers can rely on without exposing implementation secrets.
Reviewed July 28, 2026 Owner: VialAPI Platform Operations
Authorization
Server-side capability checks for protected pages, API methods, and mutations; interface hiding is never the only control.
Credentials
API keys and passwords are stored as one-way hashes. Credential scopes and operating boundaries are explicit.
Data protection
HTTPS/TLS in transit, account-scoped data access, private-cache policies, and redaction of sensitive values from logs and customer artifacts.
Integration safety
Idempotent order writes, signed webhook delivery, replay protection, deterministic sandbox behavior, and least-privilege scopes.
Operations
Readiness checks, required-job freshness, incident tracking, audit events, structured request references, and release verification controls.
Shared responsibility
VialAPI protects the platform boundary and enforces the permissions configured for each workspace. Customers are responsible for safeguarding their credentials, granting only necessary access, reviewing their users and integrations, and promptly reporting unexpected activity.
Production credentials should never be placed in browser code, shared documents, chat transcripts, or source control. Integrations should verify webhook signatures against the exact raw body and deduplicate every event.
Data handling
Business account, customer, order, pricing, and financial data are separated by authorization scope. Public documents and price sheets use purpose-built projections that omit internal cost, pricing-level names, source evidence, supplier details, and private notes unless the recipient is explicitly entitled to them.
VialAPI uses necessary session cookies and operational telemetry. It does not use customer data for advertising. The Privacy Policy explains controller and processor responsibilities in more detail.
Report a security concern
Do not include passwords, API keys, customer records, or exploit payloads in an initial report. Use the instructions on the Support page and identify the message as a security report. We will establish an appropriate secure channel for supporting material.