Security Policy

Last updated 2 November 2026

This policy is from Zedapex Limited, Lagos and explains how we protect Spyvoo and how to report a vulnerability.

1. How we protect Spyvoo

• HTTPS on every connection.
• Passwords stored only as secure, salted hashes. You can also log in with your VooSquare Voo ID, the single sign-on shared across Zedapex tools.
• Secrets such as provider API keys stored encrypted.
• Sessions in a secure cookie that you end by logging out; deleting your account ends every session.
• Strict browser security headers and protection against cross-site attacks.
• Rate limits against abuse, scraping and password guessing.
• Admin access limited to our team, with admin actions recorded in an audit log.
• Payments on Gatevoo's checkout; we never handle card numbers.

2. Your part

Use a strong, unique password, never share your login, log out on shared devices, and tell us at [email protected] straight away if you think someone else used your account. We will never ask for your password.

3. Reporting a vulnerability

Email [email protected] with the subject "Security report". Include what you found, where, the steps to reproduce it and what an attacker could do. We will confirm receipt, keep you updated and tell you when it is fixed.

4. Rules for good-faith research

• Test only with accounts you own.
• Never access, change or delete other people's data; stop and tell us if you reach it.
• No denial-of-service, spam, social engineering or physical attacks, and no testing of our providers' systems.
• Give us reasonable time to fix the issue before telling anyone else.

If you follow these rules, we will not take legal action against you for your research. We do not run a paid bug bounty at the moment, but we are glad to thank researchers publicly with their permission.

5. Breaches

If a breach affects your personal data, we tell you without undue delay and notify the authorities as the law requires.