Security

VILIQ asks people to rely on what it publishes when money is involved. That obligation shapes the engineering more than any feature does.

Authorisation in depth

Roles live in a dedicated table that only privileged code can write, never in user-editable account metadata. Every decision is enforced on the server and again by row-level security in the database — two independent layers, neither trusting the browser. Row-level security is enabled and forced on every table, and an automated test fails the build if any table is missed.

High-risk actions require more than one person

Treasury movements and account impersonation require a stated reason and a second approver who is not the actor. Every privileged action writes an audit record, and the audit log is append-only: database triggers reject updates and deletes outright.

Nothing we publish can be quietly rewritten

Recorded predictions cannot be altered, re-judged or deleted — including the wrong ones — so a track record cannot be curated by removing the losing calls. These are database constraints, not policies.

The AI cannot invent facts

VILIQ Research explains; it never sources. Prices, scores, licence statuses and registrations must come from a validated tool result, and an answer containing a number no tool produced is withheld rather than sent. Authorisation is enforced inside the tool layer, so a model persuaded to call a privileged tool still cannot reach data the member is not entitled to.

Retrieved content is data, not instructions

Web pages, documents and project descriptions frequently contain text addressed to an AI reading them. VILIQ wraps untrusted content so it is read as quoted material, detects injection attempts, and reports them instead of acting on them.

Secrets and transport

No secret is committed to the repository, and an automated scan blocks a release if one appears. Provider errors are redacted before they reach a browser, because upstream messages routinely echo API keys. A strict Content Security Policy, HSTS and a deny-by-default framing policy are applied to every response.

Wallets and keys

VILIQ never stores seed phrases or private keys and never asks for them. VILIQ does not connect to wallets of any kind. The whole product works without a wallet.