Security and data

A luxury concierge service holds sensitive information: the habits of well-known people, villa codes, private conversations, amounts. This chapter explains how Vetexis protects access to your account, what is logged, what is kept, and how to retrieve or erase your data.

15.1 Signing in, in two steps#

Each sign-in asks for two proofs:

1. your email address and your password;
2. a six-digit code received by email, valid for ten minutes, single use.

If two-factor authentication is turned on (15.2), a third code is requested.

Why. A password on its own can be stolen or guessed. The email code also proves that you have access to your mailbox. The code is tied to your sign-in attempt: the password step cannot be skipped.

What Vetexis never says: whether an address has an account. A refused sign-in always shows “Incorrect email or password.”, and both sign-up and forgotten password respond in the same way whether the address exists or not. It is the email received that tells the truth, to the address holder alone.

Limits against attacks: beyond a certain number of codes requested or wrong passwords for an address, Vetexis slows things down (“Too many attempts. Try again in a few minutes.”), even with the right password.

The password: at least 10 characters, not too common, and not the same as your email address. A sentence that is easy to remember makes a good password. You change it in Settings › Security › Password › Change (the current one, then the new one twice); your other sessions are then closed. An account created before passwords were introduced offers Create my password.

Forgot password (sign-in page): your address, a code by email, then the new password twice. All your sessions are closed.

The session stays open for 30 days, extended each time you use it.

15.2 Two-factor authentication#

Where: Settings › Security › Two-factor authentication › Enable. Recommended for owners and managers, whose accounts open up finance and settings.

1. Scan the QR code with an authenticator app (Google Authenticator, 1Password, Authy…), or enter the key by hand. The QR code is drawn in your browser: the secret does not pass through any third-party service.
2. Enter the six-digit code shown.
3. Save the recovery codes, shown only once. Each one replaces the app code once if you lose your phone. Copy codes, then I have saved my codes.

When you sign in, after the code received by email, the “Two-factor authentication” screen asks for the app code or a recovery code. At the fifth wrong code, the attempt is closed and you have to start again from the password. A code that has already been used cannot be used again.

Disable asks for an app code or a recovery code.

15.3 Sessions and the account#

Settings › Security › Open sessions: one line per device (“Chrome · Windows”, “Active 5 min ago · opened 3 October”), yours marked “This session”. Disconnect closes a session you do not recognise.

Danger zone:

• Sign out everywhere: closes all your sessions, including this one.
• Deactivate my account: nobody can sign in to it any more and your sessions are closed. Your data is kept. You have to type your address and your password again. To reactivate the account, you need to write to info@vetexis.com. Owner of an active concierge service? Close it first, or appoint another owner.

15.4 Isolation and permissions#

• Each concierge service is sealed off. The database itself refuses to show one concierge service data from another: there is no “forgotten” query that could leak.
• Permissions are checked by the server, never just by the screen (chapter 12). A field account that tried to open the record of a client outside its assignments gets the same response as if it did not exist.
• Property access codes are encrypted and can only be read through an explicit, recorded action.
• Media (photos, voice notes, documents) are only accessible through signed links valid for ten minutes. Photos are stripped of their metadata (GPS position, device) when they are saved.
• Public links (quotes, payment, supplier space) are personal and signed; a supplier link can only be used once.
• The assistant never sees costs, margins, codes or other clients. Client messages are treated as data, never as instructions: a client who writes “ignore your rules” gets nowhere.

15.5 What is logged#

Where: Settings › Privacy. Who: the owner and managers.

The access log#

Each read of sensitive data is recorded: who, when, what, on which item.

Filters by type of access, period and client. This log cannot be erased. It is the record you show a client who asks “who has seen my messages?”.

AI disclosures#

Each time the assistant replied “I am a program” to a client who asked plainly whether they were talking to a machine: the date, the client, the language and the question asked. This is the transparency requirement of the European AI Act (Article 50). After a client is erased, the question is no longer kept (“Not kept”); the date and language remain as proof.

The activity log#

On the Team page: the team's last fifty actions (bookings, invoices, clients, roles changed, invitations, settings changed, passwords), each in one readable sentence (chapter 12).

15.6 Data retention: keep everything, erase nothing#

Vetexis erases nothing automatically. Not messages, media, transcriptions or records, not when the concierge service is closed, not at the end of a subscription, not when an account is deactivated. There is no retention period setting.

Why. A concierge service works over the long term: the client who comes back three years later expects to be remembered. And data erased by mistake does not come back. Erasure is therefore always a deliberate, human action:

• erasing a client at their request (right to erasure, GDPR Article 17): chapter 7, section 7.10;
• deleting a note, an invoice draft, a stay, a document.

Issued invoices are never erased (an accounting obligation); they are cancelled.

15.7 Exporting all your data#

Where: Settings › Privacy › Export all data › Download the export. Who: the owner and managers. When: on every plan, even after cancellation or closure.

A .zip archive of CSV files: team, clients, properties, suppliers, catalogue, bookings, assignments, conversations and messages, invoices, quotes, payments, reports and Vetexis invoices, with the PDFs of your issued invoices and a README file. The files open in a spreadsheet (semicolon separator, amounts in cents, dates in universal time). Costs and margins are included: they are your data. Not exported: secrets (encrypted access codes, tokens) and the assistant's internal workings.

Other, more targeted exports:

• a complete client record (JSON): record › “…” › Export record;
• the client list (CSV): Clients › Export the list (CSV);
• a conversation: thread › “…” › Export conversation;
• issued invoices for a period (CSV): Invoicing › Export (CSV).

Each export is recorded in the access log.

15.8 Closing the concierge service#

Where: Settings › General, Danger zone, Close the concierge service. Who: the owner only. You have to type the concierge service's name again.

What closing does:

• the subscription stops straight away: no more invoices or charges;
• WhatsApp numbers are disconnected: no more messages arrive;
• the team can no longer work in the application: it remains available in read-only mode;
• your data is kept by Vetexis, and the full export remains available at any time.

Resuming a subscription reopens the concierge service as it was.

Close or cancel? Cancellation (chapter 14) lets the subscription run until the end of the paid period. Closing stops everything immediately and disconnects WhatsApp.

15.9 On the phone, without a connection#

The installed application keeps your session and the day's assignments readable offline, nothing else: not the inbox, clients, invoicing or access codes. Everything is erased when you sign out and when the session expires.

15.10 Examples#

A worried client. Mr Laurent asks who read his messages last month. Sofia opens Privacy › Access log, filters on “Conversations” and the client: two reads, by Marco and by herself, with dates. She can tell him.

A lost phone. Marco loses his phone. From his computer, he opens Security › Open sessions and closes the phone's session. As his two-factor authentication was on that phone, he will then sign in with one of his recovery codes, and turn two-factor authentication on again on the new one.

Someone leaves. A concierge leaves the concierge service. Sofia removes her from the team: access is cut off immediately, her past actions stay in the log, and her notes and messages stay in the records.