Security & Compliance

Univio is engineered with a strict multi-tenant isolation model built upon InstantDB's declarative permission system (instant.perms.ts). Security boundaries are enforced directly at the database layer rather than relying merely on client-side UI filters.

Every query and mutation must satisfy mathematical relationship bindings (e.g. verifying that the requesting user's authenticated ID exists within the resolved club's active membership graph). Orphan queries and unauthorized traversals are blocked by default.

All platform communication occurs over Transport Layer Security (TLS 1.3) with modern cipher suites, preventing eavesdropping or man-in-the-middle tampering on campus Wi-Fi networks.

Single Sign-On (SSO): Univio supports passwordless authentication via Google OAuth 2.0 and verified magic link tokens. This eliminates the vulnerability of reused or compromised passwords across campus.

Role-Based Access Control (RBAC): Within an organization, permissions are broken down into granular capabilities:

• members.manage: Authority to promote, demote, or remove club members.
• recruitment.admin: Ability to build custom forms, view applicant resumes, and score candidates.
• finance.approve: Authority to review and approve treasurer reimbursement payouts.
• events.manage: Permission to launch signed check-in scanners and export rosters.

Server-side API handlers (api.clubs.update.ts, api.roles.recalculate.ts) strictly validate administrative caller permissions before allowing role assignments or club setting changes.

Univio partners with Whop Inc. (@whop/checkout) to process all subscription payments. Whop is certified as a PCI-DSS Level 1 Service Provider—the most stringent level of certification in the global payments industry.

When purchasing a subscription, payment details are tokenized directly within Whop’s PCI-compliant vault. Univio servers never receive, transmit, or store Primary Account Numbers (PANs), expiration dates, or CVV codes.

Treasurer reimbursement records, receipts, and line items stored within Univio are visible solely to authorized financial officers and are retained for internal organizational audit trails.

All files uploaded to the Memory Bank, recruitment candidate resumes, and receipt images are stored via InstantDB Storage (db.storage).

Files are encrypted at rest using AES-256 and served through authenticated, signed URLs. Access to candidate resumes is restricted strictly to members who hold recruitment review permissions within that specific organization.

Files cannot be indexed by public search engines or downloaded by non-authenticated third parties.

Many student organizations require accurate attendance records for voting eligibility, Greek life compliance, or university funding requirements. Univio protects against attendance fraud through our cryptographic check-in system:

• Check-in QR tokens are generated with high-entropy randomized secrets linked to the specific attendee.
• Tokens incorporate a validity timestamp and signature verified by /api/checkin-token.
• Once scanned by an officer's camera, the token is permanently consumed, preventing duplicate redemption.

Univio values the contributions of the campus security community and independent security researchers. If you believe you have discovered a vulnerability in our platform, we encourage you to report it to us promptly.

Guidelines for Responsible Disclosure:

• Submit findings directly to security@univio.co.
• Include reproducible steps, proof-of-concept payloads, and affected endpoints.
• Provide us reasonable time to remediate the vulnerability before disclosing it publicly.
• Do not attempt to access, exfiltrate, or delete another student organization's actual data.

We acknowledge valid security submissions and actively credit researchers who help us keep student organizations safe.