Domain ownership defines organization access
An organization administrator publishes a DNS TXT challenge before a domain is verified. Organization searches, employee profiles, exports, and notification configuration are restricted to the verified scope. Website-domain scope and work-email scope answer different questions. Platform administrators operate the index and are a separate privileged role.
Credentials are sensitive records
Credential evidence can include complete password values. Access requires an authenticated, authorized session and is subject to access controls and auditing. Treat any revealed credential as highly sensitive. These controls are not a claim that credential values are encrypted fields at rest.
Employee-profile responses omit passwords, hashes, and original URL paths. Management PDF reports omit passwords, account identities, original URLs, and custom priority labels. Detailed CSV exports can contain credential values and require the same care as the underlying records.
Team permissions and authentication
Organization administrators manage teammates, verified domains, priorities, and notifications. Viewers investigate records and read settings without changing configuration. Email verification codes protect the organization sign-in flow. Disabling an organization user ends that user's sessions. Platform and organization operations have separate audit visibility.
Notifications and integration secrets
Email and chat notifications may contain account-and-host examples, but they do not contain passwords. Generic webhooks carry counts and a workspace link without account or password values. Webhook messages are signed; follow the integration setup instructions to validate messages. Integration URLs and signing secrets need restricted handling.
Private workspace boundaries
Customer search results belong in the authenticated workspace, not in public editorial pages or shared browser caches. Contact the team with questions about retention, removal, or organization-specific handling requirements.
Vuxep presents observed evidence. It does not test exposed passwords against live services, provide session cookies, or automatically reset accounts. This page describes implemented controls and does not assert a certification or an external security audit.
Security contact
Send a vulnerability report or data-handling question to [email protected]. Include the affected component and a reproducible description. Use fictional examples in the initial email and arrange a suitable channel before sharing sensitive records.
Read the privacy information, methodology, and sample report.