Legal

Security & Responsible Disclosure

Last updated: 2026-10-11

Unveil is built and operated by Aryabhatta Labs. We take the security of the Unveil platform and our customers' prototypes, feedback and workspace data seriously, and we welcome reports of suspected vulnerabilities from independent security researchers.

This page covers security practices and disclosure specific to Unveil. For Aryabhatta Labs' company-wide policy, see the Aryabhatta Labs Security & Responsible Disclosure Policy.

How We Protect Your Data

• Data in transit is encrypted using TLS, including the connection between Unveil and its database, which verifies the server's certificate.
• Uploaded prototypes are served from a separate origin (proto.unveilui.com), so a prototype's scripts cannot read your Unveil sign-in session.
• Every state-changing request is protected by a per-session CSRF token and an origin check.
• Passwords are stored only as salted argon2id hashes. Sign-in attempts are rate-limited per account and per address.
• Access to production systems and customer data is restricted to authorized personnel and logged.
• Support access to your workspace's data follows the consent and audit process described in our Terms of Use and Privacy Policy.
• We monitor our infrastructure and dependencies for known vulnerabilities on an ongoing basis.

Account & Workspace Security Features

• Each workspace is isolated: its data lives in its own database schema, and sessions from one workspace are refused by another.
• Role-based access control (administrators and members, with project owners), enforced on every request.
• An append-only audit history of workspace activity.
• Invitation links and prototype access codes are single-use and expire.
• Read-only, revocable integration tokens for connecting other tools to accepted feedback.

Backup & Recovery

Unveil's database runs on a managed data platform with automated backups, and uploaded prototype files are stored on encrypted volumes with daily snapshots, so your data can be restored in the event of infrastructure failure.

Reporting a Vulnerability

If you believe you've found a security vulnerability affecting Unveil (app.unveilui.com, proto.unveilui.com, this website, or supporting infrastructure), please report it using Aryabhatta Labs' vulnerability report form — select "Unveil" as the affected product. Please include:

• A description of the vulnerability and its potential impact.
• Steps to reproduce, including any proof-of-concept code, screenshots, or logs.
• The URL, screen, or system affected.
• Your contact information, so we can follow up with questions.

You can also reach us via the Unveil contact form using the "Security Issue" category.

Our Commitment

When you report a suspected vulnerability to us in good faith, we commit to:

• Acknowledge receipt of your report in a timely manner.
• Investigate and validate the report.
• Keep you informed of our progress toward resolution.
• Remediate confirmed vulnerabilities within 90 days of confirmation, prioritized by severity and impact.
• Publicly credit researchers who wish to be acknowledged, once a fix has been deployed, unless anonymity is requested.

Bug Bounty

We don't currently offer a paid bug bounty program. Valid reports are eligible for public credit (see Our Commitment above), but not monetary reward.

Responsible Disclosure Guidelines

To help us protect our customers and systems, we ask that you:

• Give us at least 90 days from the date of your report to investigate and remediate an issue before disclosing it publicly.
• Make a good faith effort to avoid privacy violations, data destruction, and interruption or degradation of the Service.
• Only interact with accounts and workspaces you own or have explicit permission to access.
• Do not exploit a vulnerability beyond what is necessary to confirm its existence.
• Do not use automated scanning tools that generate significant traffic or load against our systems without prior authorization.

Safe Harbor

We consider security research conducted in accordance with this policy to be authorized. We will not pursue legal action against researchers who make a good faith effort to comply with this policy, and we will work with you to understand and resolve the issue quickly.

Scope

This policy applies to the Unveil web app, the prototype content origin, this website, and the infrastructure that supports them. Vulnerabilities in third-party services we integrate with should be reported directly to that third party. Prototypes uploaded by customers are their own content; report a malicious prototype through the contact form so we can act on it.

Data Retention & Deletion

Retention periods for your data, and how to request deletion, are covered in our Privacy Policy.

Questions

You may direct any other questions about this policy by contacting us via the Unveil contact form or the Aryabhatta Labs contact form.