Security Best Practices

Production security guidelines for integrating Veilio.

Key management

• Use one API key per environment (dev, staging, prod)
• Use MIGRATION keys only for historical imports — rotate or revoke after migration completes
• Rotate keys periodically (quarterly recommended)
• Revoke unused or compromised keys immediately from Dashboard → API Keys

Secret handling

• Store keys in a secrets manager (AWS Secrets Manager, GCP Secret Manager, Vault) or secure environment variables
• Never hardcode keys in source code or commit them to Git
• Never expose API keys in browser bundles, mobile apps, or client-side JavaScript
• Restrict CI/CD secrets to deployment pipelines only

Access control

• Call Veilio from your backend only — the API key must never reach end-user devices
• Restrict detokenization to authorized services and user roles in your application (Veilio does not enforce your RBAC)
• Pass username on every detokenize so audit logs identify the end-user of your app — see Client app governance
• Require a business reason on every detokenization call (enforced by Veilio audit logs)
• Use column policies on datasets to limit which roles can download which fields
• Assign VIEWER role only to users who must not tokenize or shred

Data handling

• Store tokens by default, not raw PII
• Detokenize only at the last possible moment in a workflow (send email, generate PDF, open support ticket)
• Never detokenize on page load to display raw data in the browser
• Avoid writing detokenized values to application logs, APM traces, or error reports
• Mask tokens in UI when full value is not needed (tok_abc1...)

Reliability and abuse protection

• Implement retries with backoff for 429 responses (SDKs do this automatically)
• Add alerts for repeated 401, 403, and 5xx from your integration
• Monitor request volumes by environment and API key
• Use bulk endpoints for imports to reduce request count and rate-limit risk

Retention and erasure

• Set retention.ttlDays or retentionUntil at tokenization for time-limited data
• Call POST /tokens/shred (or shredToken / shred_token) on GDPR deletion requests
• Document your data retention policy and align TTLs with legal requirements
• Test shredded tokens return HTTP 410 (TOKEN_SHREDDED) — your app must handle this gracefully

Encryption and architecture

Veilio SaaS runs on isolated infrastructure. On-premise deployments keep all tokenized data on your servers — Veilio never receives your business data.

Network (on-premise)

• Terminate TLS at a reverse proxy (nginx, Traefik, Caddy) in front of the Veilio container
• Restrict inbound access to trusted networks or VPN
• Allow outbound HTTPS only if using automatic license refresh, the weekly usage report, telemetry (last-seen), or the in-app update banner. Air-gapped instances need none of these.
• Back up ENCRYPTION_KEY and PostgreSQL volumes off-server (see Installation guide)

Compliance and audit

• Enable SIEM integration for centralized audit on Enterprise / on-premise
• Export audit logs periodically via dashboard compliance tools
• Use offboarding workflow for structured account exit and data portability
• Run dump compliance checks before sharing database exports

Trust and legal

For DPA, subprocessors list, and security questionnaires, contact support@veilio.fr or https://veilio.fr/contact.