Practices and standards
How we operate, and what that does not mean.
This page describes concrete practices in use today and the standards that frame the work. It does not claim certification, attestation or formal compliance — none of which exist without an audit by a competent body.
Practices in use
Each line maps to real configuration. When a practice changes, the line changes or goes.
- Exposure
- The application runs on loopback and is exposed only through a Cloudflare tunnel. It is not published directly on the local network.
- Headers
- Content-Security-Policy with a per-request nonce and strict-dynamic. Scripts without the nonce do not execute, third-party ones included.
- Identity
- Authentication through Keycloak OIDC, with the session bound to the issuer that created it.
- Second factor
- MFA required for moderation actions, with its own audit record for every verification.
- Private surfaces
- Console, authenticated API and login sit behind a session and are excluded from indexing in robots.txt.
Standards that frame the work
Four standards shape the work. Each page sets out what the standard requires, what Velqory does, and what only an auditor can declare.
What this page does not claim
- Velqory is not ISO 27001 certified and not SOC 2 attested.
- No customer becomes certified or compliant by working with Velqory.
- Certification and attestation depend on an audit by a competent body and a valid certificate.
- This page does not replace legal advice, a certifying audit, or the customer’s own management.
Need to assess this in detail?
For supplier due diligence, we answer security questionnaires with the documentation behind every statement above.