Transport & realtime
| Standard | Use at Venoly |
|---|---|
| HTTPS / TLS | All traffic is encrypted in transit; TLS is terminated at the edge. |
| REST + JSON | The application API is a JSON-over-HTTPS REST surface. |
| WebSocket | The realtime gateway uses WebSocket; every inbound payload is schema-validated before reaching application logic. |
| WebRTC (SFU) | Voice, video, and screen-share run over WebRTC through a selective forwarding unit, separate from the API. |
Identity & developer platform
| Standard | Use at Venoly |
|---|---|
| OAuth 2.0 | Third-party apps and bots authorize via OAuth2 with scoped tokens. See the developer platform. |
| TOTP (RFC 6238) | Time-based one-time-password two-factor authentication, with single-use backup codes. |
| HttpOnly / SameSite cookies | Session/refresh tokens live in HttpOnly, Secure, SameSite cookies — never in browser storage. |
Open formats Venoly publishes
| Format | What it is |
|---|---|
| .vnl policy format | An inspectable, indent-based security-policy language compiled to bytecode and evaluated on a sandboxed VM. Policies are human-readable files communities can share and import. |
| llms.txt | A machine-readable overview for AI assistants and answer engines, at /llms.txt and /llms-full.txt. |
| schema.org / JSON-LD | Structured data (Organization, SoftwareApplication, TechArticle, FAQPage, BreadcrumbList) embedded across these pages. |
| RFC 9116 (security.txt) | A published security contact and disclosure policy at /.well-known/security.txt. |
| Sitemaps + robots.txt | A standard XML sitemap and a robots policy that explicitly welcomes AI crawlers. |
| Android App Links | A published assetlinks.json so https://venoly.nl/... deep-links open in the Android app. |
Compliance frameworks
Venoly is built EU/GDPR-first and implements EU Digital Services Act obligations (notice-and-action, statements of reasons) as a first-class subsystem, alongside AI-use disclosure, cookie consent, and a child-safety policy. See transparency reporting and the privacy policy.
