Where your firm's data lives
This page says plainly where the data you put into Vellum lives, which providers process it, and how we control who can reach it.
Where the data lives
- Project files
- DigitalOcean Spaces
- London, United Kingdom
- Database: projects, clients, events and reviews
- DigitalOcean Managed PostgreSQL
- Frankfurt, Germany
- Accounts and passwords
- Google Firebase Authentication
- United States
- Subscription and payments
- Stripe
- Ireland / United States
- Application monitoring
- Grafana Cloud
- European Union
- Transactional email
- Google (Gmail / Google Workspace)
- —
- This website
- Cloudflare + DigitalOcean
- —
Access
Access is per company: only people on your team see your firm's data. Each person has a permission level — Admin or General — that decides what they can manage and delete.
In the client portal, each client only sees their own projects and, within them, the files of stages marked as client review. Download links for those files expire after 15 minutes.
In transit
The website and the app only work over HTTPS. Plain HTTP requests are redirected to HTTPS, and both send the HSTS header, which tells browsers never to fall back to an unencrypted connection.
Passwords
Passwords are handled by Google Firebase Authentication — Vellum never stores them in its database. When you create a client's account, the generated password goes straight to Firebase and, if you ask, to the client's email.
You sign in with email and password; there's no two-step verification yet.
If you cancel
Cancelling your subscription doesn't delete your data automatically. There's no export inside the product: if you want a copy of your data, or want us to delete it, ask support.
Contact
Questions about security or your firm's data: write to [email protected]. For the data this website collects, see the privacy policy.