Security
Clear about the site. Clear about what is not live yet.
This page describes the public website as it ships — headers, contact, no ads — and the intended shape of the signed-in hub. It is not a certificate and not a scan grade.
29 October 2026
No ISO 27001, SOC 2, or public scan grade is claimed for vectorplan.eu from this page.
Three layers
Website, hub design, sign-in
This website
The public pages need no account, and no payment is taken. There is no sign-up form; sign-in is for existing crew accounts. Contact opens your email app to support@vectorplan.eu. This frontend does not load advertising or a third-party analytics tag. Responses send Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options.
Hub design
A customer account is designed to hold crew content — names, chat, briefings, pack lists, and, on motorsport, optional map location and receipt images — with account isolation, encryption of sensitive fields, an audit log, and export or erasure on request. That processing belongs to the signed-in product, not these marketing pages.
Sign-in honesty
Sign-in works: email and password, two-step sign-in (authenticator app, email code, or recovery code), and crew codes. The session is held in HttpOnly cookies on this site. Password reset by email, account recovery by email, crew invites by email, and read-only share links are coming soon — those screens do not send anything yet.
Measures
Intended hub measures
These cards describe product design for the signed-in hub. Sign-in and two-step sign-in are live; the cards are not a claim that every measure below, such as crew-data encryption or audit logging, is already in place.
Encryption (design)
Sensitive hub fields and uploaded files are intended to be encrypted at rest for the customer’s account. Account passwords are meant to be stored with a modern password hash — not as plain text.
Account isolation (design)
One crew’s briefings, chat, and pack lists are intended to stay in that account. Other customers should not read them. Share links, when issued by the hub, are meant to be limited views you choose — not open by default.
Audit log (design)
The hub is designed so important account actions — sign-in attempts, role changes, exports — can be recorded for the customer who owns the crew.
Export and erasure (design)
Customers should be able to export their crew content and request erasure under the contract and the privacy policy. The marketing site itself does not store crew files.
Browser and connection (live site)
This website sends CSP, HSTS, and X-Frame-Options on responses. Pages are public. Contact is mailto. There is no payment form and no ad or analytics tag in this frontend.
EU hosting plan
The intended host for the Vector Plan application is in the EU (Scaleway, Paris), in the same family as the rest of the Vector stack. Treat that as the deployment plan for the product — not as a public scan badge on this page.
Hosting, fields, testing, and limits
Where it runsEU Scaleway plan for the app; this site is public marketing.
Domain DNS for vectorplan.eu is handled by the registrar. The application is planned on Scaleway in Paris (EU). These marketing pages do not upload crew files. Details of services that may touch data later sit on the subprocessors page.
What the hub is meant to holdCrew ops content for the week desk.
Designed categories include account name and email, crew chat, briefings, tasks, pack lists, calendar items, and — where a planner uses them — map location and receipt-scan images on motorsport. Special-category data is not requested.
TestingNo public grade claimed from this page.
We do not publish ISO 27001, SOC 2, CryptCheck, or Observatory grades for vectorplan.eu on this page. When the hub is connected, testing belongs to that product’s release process — not to a badge row here.
Report a problemsupport@vectorplan.eu
If you find a security problem on vectorplan.eu, write to support@vectorplan.eu with enough detail to reproduce it. Please do not access other people’s data, and do not disrupt the service. We will acknowledge reports we can act on.
Honest limitsWhat this page will not claim.
No certificate. Sign-in and two-step sign-in are live; there is no claim here that crew-data encryption is already in place. Some hub screens are still being connected, and email invites and share links are coming soon. Paid plans start only when you and the operator agree off this site.
Short security FAQ
Does this website create an account or take payment?
No. There is no sign-up or payment form on this site. The marketing pages are public, sign-in is for existing crew accounts, and Contact opens your email app.
Is sign-in connected?
Yes. Sign-in with email and password, two-step sign-in, and crew codes work, and your account session is live. Email invites, password reset by email, and read-only share links are coming soon.
Where will crew data live?
The intended host for the signed-in hub is in the EU (Scaleway, Paris). This marketing frontend does not store crew files.
Do you claim ISO 27001 or SOC 2?
No. This page does not claim those certifications or a public scan grade.
How do I report a vulnerability?
Email support@vectorplan.eu. Prefer clear steps to reproduce. Do not access other people’s data.
Data processing and contact
A data processing note and the subprocessors list are published for when a customer contract exists. Reading them does not sign a contract. For a person, use Contact or write to support@vectorplan.eu.
No ISO 27001, SOC 2, or public scan grade is claimed for vectorplan.eu from this page.