Security built in, not bolted on.
Velanier handles invoices, payments, and financial records, so we treat access control, data isolation, and encryption as baseline requirements — not a checklist filled in later. Here’s exactly what’s live in production today.
What’s actually in place today.
Here's the architecture itself, in plain language.
Encrypted in transit
Every request between your browser and Velanier runs over HTTPS/TLS — nothing is sent in the clear.
Role-based access
Access is scoped by role (Admin, Finance Head, Accounts) at the API level, so people only see the actions their role permits.
Per-organisation isolation
Every account, invoice, and record is scoped to your organisation in the database — one tenant cannot query or see another tenant’s data.
Hashed credentials
Passwords are hashed with bcrypt and never stored in plain text. Sessions use short-lived access tokens with separate refresh tokens, not long-lived static keys.
Audit trail
Key actions across AP and AR — approvals, edits, syncs — are written to an audit log scoped to your organisation.
Locked-down access
The API only accepts requests from an allowlist of known origins — there’s no open cross-origin access to your data.
Questions, answered.
What finance and IT teams usually ask before trusting Velanier with financial data.
On Railway, a managed cloud platform, in Railway’s US West region, backed by PostgreSQL. Data for each organisation is logically isolated at the database level.
Only users you’ve added to your organisation, scoped by the role you assign them. Velanier staff do not have standing access to customer financial data outside of active support requests.
Yes — talk to us and we’ll walk your security or IT team through the architecture directly, including anything not covered on this page.