Velcun moves rates, loads and invoices — so the platform is engineered to the standard money infrastructure gets held to. Every control below is implemented in the product and covered by the automated test suite; the full mapping lives in the controls document.
scrypt password hashing · JWT sessions with pinned secrets · revocable API keys shown once · per-key least-privilege scopes enforced by a single auditable permission matrix · OIDC enterprise SSO with provider-verified signatures and email-domain provisioning
TLS via Cloudflare with HSTS · nosniff / DENY / referrer headers on every response · per-identity rate limiting with Retry-After · configurable origin allowlist · request correlation IDs end to end
every domain event persisted with org, type and payload · login and key-management security events · full access logs · Prometheus metrics · liveness and deep health endpoints
integer-cents accounting, no floats · append-style revenue ledger with idempotent capture · exactly-once micro-toll billing · Idempotency-Key replay protection on load creation · server-side lifecycle state machine
secrets never committed · ephemeral-secret deployments fail loudly · PostgreSQL verified (full suite passes on Postgres 16) · nightly automated backups with rotation · restart-on-crash services
External certification (SOC 2 / ISO 27001) requires an accredited auditor — the controls they would test are mapped and implemented today. Known limitations are stated in the controls document, not hidden.