Security

VeltriqAI™ is delivered as a hosted service running on managed cloud infrastructure operated by a vetted third-party hosting provider. That provider is listed among our sub-processors in our Privacy Policy. We do not offer an on-premise deployment.

Production and non-production environments are kept separate, and customer data is never copied into development or test environments. Each customer workspace is logically isolated, so one organization's records are never reachable from another. Backups are taken on a regular schedule to support recovery.

All traffic between your browser and the platform is encrypted in transit using TLS. Data at rest, including database records and uploaded documents, is encrypted using industry-standard encryption.

Documents you upload, such as credit applications and supporting files, are stored privately and are reachable only through short-lived signed links generated for an authorized user. Files are never exposed at a permanent public URL.

Account credentials are handled by the platform's identity layer and are never stored in plaintext by VeltriqAI™.

Access to customer data is governed by role-based access control. Every user holds a role that determines which records and actions are available to them, and those rules are enforced on the server, not only in the interface.

Data access is scoped to the workspace it belongs to, so users of one organization cannot read or modify another organization's records. Workspace administrators control who can invite users and which roles they hold.

Internally, access to production systems follows least privilege. Access is granted per individual rather than shared, engineers receive access only where their work requires it, privileged actions are logged, and internal access is reviewed periodically and revoked when it is no longer needed. Administrative activity inside the platform is recorded in an audit log.

We maintain a documented incident response process. Security events are monitored and alerted on, and suspected incidents are triaged by an on-call responder who classifies severity and begins containment.

Our response steps are: detect and triage, contain, investigate and determine scope, remediate the root cause, notify affected parties where required, and complete a post-incident review that feeds back into our controls.

Where a confirmed breach involves personal information, we notify affected customers within seventy-two (72) hours of confirming the incident, as described in our Privacy Policy. Vulnerabilities uncovered during an investigation are fixed before the incident is closed.

Our SOC 2 Type II examination is complete. An independent auditor has assessed our controls against the SOC 2 Trust Services Criteria across security, availability, and confidentiality.

The audit report is available under NDA to customers and prospective customers who request it.

If you believe you have found a security vulnerability in VeltriqAI™, please report it to us. Include a description of the issue and the steps needed to reproduce it.

Please give us a reasonable opportunity to investigate and remediate before disclosing an issue publicly, and do not access, modify, or extract data that is not yours while testing. We review every report and will follow up with you directly.

This address is for security reports only. For general support or account questions, contact info@veltriqai.net.