Vitalis AI

Security

Last updated September 10, 2026

Vitalis AI connects to the advertising accounts that run your business. That access is the most sensitive thing we hold, and the design reflects it: your budget cannot move without your click, your tokens are encrypted before they touch our database, and one workspace can never read another’s data.

Controlled human intervention

Vitalis AI checks directly with you before taking sensitive actions like making payments or sending messages. That safeguard isn’t a policy - it’s enforced in the database. Any action that would move real ad dollars (launching a campaign, raising a live budget, un-pausing) or send a message is marked as needing your approval, and a Postgres trigger refuses to let it execute without a recorded human approval. Campaigns are constructed in a paused state, which costs nothing. Even if the application layer had a bug, the database would still refuse to spend your money.

Your meeting audio is not stored

Vitalis AI does not record or store the audio of your meetings, and no one here can listen to them. This is a property of the system rather than a promise about our behaviour: there is no table that holds a clip, no storage bucket to put one in, and no code path that could sign one out again. Sound is turned into words a few seconds at a time and discarded with the request that carried it. What is kept is the transcript, in your workspace, under the same row-level security as everything else - and a meeting you run as a private brainstorm is readable by you alone, enforced in the database rather than hidden in the interface.

Vitalis AI also never joins a call as a participant. There is no bot and no attendee added to your invite; it listens on the device of the person who started it, for as long as they have started it. Meetings are deleted 180 days after they happen if you have not deleted them sooner, and deleting one deletes everything under it.

Credentials

  • Access and refresh tokens are encrypted with AES-256-GCM before being written to the database. The key lives only in the application server’s environment, never in the database - so a database dump alone cannot yield a usable token.
  • Tokens are never shown back to you, never sent to your browser, and never written to logs.
  • We never ask for your Meta or Google password. You connect by logging in with the provider, and you choose exactly which ad account, Page, and pixel to share.
  • You can revoke our access at any time - from the Connections page, or directly from your Google Account permissions or Facebook Business Integrations.

Tenant isolation

Every table is protected by Postgres Row Level Security, scoped to the workspace of the signed-in user. Data access goes through security-definer functions that derive your workspace from your session - not from anything the browser sends - so a caller cannot read or write another workspace’s data by changing a request.

Infrastructure

  • Hosted on Vercel; database, authentication, and file storage on Supabase.
  • All traffic is served over HTTPS/TLS.
  • Secrets are held in an encrypted environment store, separate from source control. Our repository contains no credentials.
  • Payment card details are handled by Stripe directly. We never see or store card numbers.

AI providers

The agents run on Anthropic by default, or on OpenAI or xAI for a request where you have chosen one of their models in Loop, and creative is generated by Higgsfield and Google (Veo). Your campaign context is sent to these providers to produce plans and creative for you. Your business data and your advertising data are never used to train AI models.

Connection health

A dead credential is a security and correctness problem, so we track token expiry, renew tokens before they lapse, and detect provider errors that mean access was revoked. When that happens the app tells you plainly and asks you to reconnect, rather than silently continuing with stale or sample data.

Reporting a vulnerability

If you believe you’ve found a security issue, email support@govitalisai.com with the details and steps to reproduce. We’ll acknowledge it and keep you updated. Please give us a reasonable chance to fix it before disclosing it publicly.