What is in place today

The current build is a frontend prototype. No production customer data is collected, no real trades occur, and no funds move. Waitlist submissions are stored locally in the visitor's browser only.

Every page ships over TLS. The site enforces modern default cookie and CSP behaviour provided by the hosting platform. There is no user authentication and therefore no session token to compromise at this stage.

Security disclosures and questions: security@vestn.io (illustrative; replace before publish).

We publish a security.txt file under /.well-known/security.txt at production launch.

Q3 2026: Third-party penetration test ahead of authenticated features.

Q4 2026: Documented vulnerability disclosure programme with named response times.

H1 2027: SOC 2 Type 1 readiness assessment; scope: application, hosting, and access management.

H2 2027: SOC 2 Type 2 audit window opens once operational history is sufficient.

VESTN is not yet authorised to solicit investment. Financial promotions on this site are illustrative only and, at launch, will be approved under a UK FSMA s21 approver relationship. The named s21 firm will be published on this page once the relationship is contracted.

US-facing offerings will be structured under Rule 506(c) with issuer counsel. No offering is live on this prototype.

Waitlist and interest signals are stored in your browser's localStorage. VESTN receives them only when you explicitly submit through the waitlist form; once we do, the standard retention and deletion terms in the Privacy policy apply.

We do not use behavioural advertising trackers. Basic, cookieless analytics may be introduced before launch; if so, this page and the Privacy policy will be updated with the vendor and data categories.