Trust and security
Your data stays yours. Every answer is accounted for.
VEPICT connects to systems that hold patient records, payroll, contracts and money. It is built so that your data stays in the region and environment you choose, people see only what their access allows, AI never trains on your data, and every question, query and change leaves an audit record.
Security and compliance
The controls, and the frameworks they map to
VEPICT's security controls are documented control by control against NIST SP 800-53 Rev. 5, with each control naming the part of the platform that enforces it. Attestation reports and the full control matrix are shared under NDA.
| Framework | How VEPICT addresses it | Status |
|---|---|---|
| NIST SP 800-53 Rev. 5 | Control matrix covering access control, audit, identification and authentication, system and communications protection, and configuration management. | Control matrix |
| NIST SP 800-63B (AAL2) | Two-step verification on every password account, password rules per SP 800-63B, throttling and audited lockouts. | Implemented |
| HIPAA and HITECH | PHI classification that travels with the data, least-privilege access, tamper-evident audit, encryption in transit and at rest. Healthcare engagements run under a Business Associate Agreement. | Designed for |
| GDPR | Data kept in the region you choose, PII classification, access by purpose, and records of who saw what. | Designed for |
| SOC 2 Type II | Controls mapped to the Trust Services Criteria; report status provided in the security pack. | On request |
| ISO/IEC 27001 | Controls mapped to Annex A; certification status provided in the security pack. | On request |
Sign-in and access
- Single sign-on with your identity provider, or two-step verification on every password account
- Default-deny: one decision point checks roles, attributes and policies on every request
- Administrators hold no data access; nobody approves their own access
Encryption and secrets
- TLS on every link, including between platform services
- Stored credentials encrypted with AES-256-GCM under a rotatable master key
- No shipped secrets: every credential is generated per installation
Audit
- Hash-chained, append-only audit trail owned by a database role nobody signs in as
- Every administration change, sign-in lock and AI engine change is recorded
- Lineage shows where each number came from
Data residency and deployment
Run VEPICT where your data is allowed to live
- VEPICT-managed cloud. A dedicated environment for your organization, in the cloud region you choose (US, Canada, EU, UK, Middle East, India and more).
- Your cloud account. Deployed into your AWS, Microsoft Azure or Google Cloud subscription, under your keys and your network rules.
- Hybrid. Connectors run inside your network and send only the modeled data you approve.
- On-premises. The full platform inside your data center for the strictest environments.
Each customer's warehouse is a database and role of its own that no other customer can reach. Your source systems stay where they are; VEPICT reads from them through connections you approve.
How AI is governed
What the model sees, what it never sees, and who approves what it does
Ask, the VEPICT AI assistant, works through the same governed models and access rules as your people. Your organization sets an external-AI policy; VEPICT enforces it on every call.
- You askA question in plain language, signed in as yourself.
- Access appliedOnly the datasets and rows your access allows are in scope.
- Policy checkedYour AI policy decides which providers may be used, the highest classification that may be sent, and which tags are blocked — for example PHI, PCI and bank details.
- Model answersThe model sees the governed definitions and the query results needed for this question — and nothing the policy forbids.
- You approveAnything that would create or change something waits for your approval, and is audited.
What the model sees
Semantic model definitions (measure and entity names, joins, synonyms) and the results of the queries it runs on your behalf, limited by your access. Data carrying a blocked classification is withheld from the model.
No training on your data
VEPICT never uses your data to train models. You choose the AI engine — Anthropic Claude, OpenAI, Google Gemini, Mistral and others — and can restrict use to providers whose commercial terms exclude training on submitted data. AI can be switched off entirely.
Audit and approval
Every question, the query it ran, the engine used and any action proposed is recorded. Ask proposes dashboards and changes; nothing is created until the person asking approves it. Changes to AI engines and policy are audited administration events.
Need the detail for your security review?
We share the control matrix, architecture and data-flow diagrams, and attestation status under NDA.