Velyx Security Trust Centre
Transparent information regarding Velyx OS information-security governance, system scope, subprocessor registers, data boundaries, and prospect documentation requests.
Velyx Security Readiness Programme
Velyx is implementing a formal information-security programme aligned with SOC 2 Trust Services Criteria and ISO/IEC 27001 requirements.
The programme includes documented controls and evidence processes covering access management, tenant isolation, data handling, AI governance, human approval, audit logging, secure development, incident response, supplier management, and business continuity.
Security documentation is available to qualified prospects under appropriate confidentiality terms.
Security Scope Summary
Velyx OS Platform Engine
Multi-tenant calculation engine, document intelligence parser, P&L scenario planner, and interactive demo sandboxes hosted in Next.js serverless architecture.
Logical Tenant Boundaries
Middleware-enforced TenantContextValidator ensuring strict tenant data separation and role-based permissions across viewer, operator, and admin tiers.
Model Data Handling Terms
Model-provider data-handling and retention terms are reviewed and confirmed per engagement before any client data is processed.
Operating Principles
Evidence Before Assertion
System recommendations and commercial estimates link directly to verified source line items, explicit formulas, and reviewable assumptions.
Human Accountability
Consequential decisions—such as issuing quotes, modifying budgets, or approving orders—require explicit human review and sign-off.
Client Model Alignment
Velyx AI is configured around your company's specific operational logic, data schemas, approval hierarchies, and commercial rules.
Clear Assumptions & Exceptions
Data gaps, unverified price points, and formula anomalies are surfaced as explicit review flags rather than hidden behind black-box outputs.
Controlled Action, Not Autonomous Choices
Automation handles data ingestion, classification, line-item parsing, and scenario calculations. Final execution actions remain strictly under leadership control.
Subprocessor & Supplier List
Third-party cloud infrastructure and API suppliers utilized by Velyx OS.
| Subprocessor Name | Service Provided | Data Handling Terms | Assessment Status |
|---|---|---|---|
| Vercel Inc. | Serverless web application hosting, Edge CDN, TLS termination | Confirmed per engagement | VERIFIED |
| OpenAI LLC | Generative AI model API (GPT-4o / O3) | Confirmed per engagement | VERIFIED |
| Google Cloud Platform / Gemini API | Generative AI model API & cloud infrastructure | Confirmed per engagement | VERIFIED |
| GitHub Inc. / Microsoft | Source code version control, CI/CD Actions | Confirmed per engagement | VERIFIED |
Data Boundaries
All demonstrations on velyxai.com use synthetic or illustrative data. Velyx does not claim access to visitor systems or real business records. Public visitors should not submit confidential data.
Client data handling, storage parameters, retention periods, access boundaries, and system connectors are defined during formal discovery and documented in agreed project scope.
No claims are made regarding specific storage durations, encryption algorithms, or geographic server locations unless explicitly verified in written client scope documents.
Evidence Lineage
Velyx AI is architected to trace every calculated output back to its origin. Whether parsing a BOQ spreadsheet or calculating project margin risks, operational figures maintain direct reference to source line items, document pages, and transformation rules.
Security & Delivery Approach
Factual evaluation status categories for enterprise IT and security procurement review.
| Item Name | Category | Status Label | Description |
|---|---|---|---|
| Discovery Security Questionnaire | Assessment & Governance | Available on request | Detailed security review documentation for enterprise procurement teams. |
| Deployment Architecture Discussion | Architecture | Available on request | Technical evaluation of cloud, hybrid, or VPC deployment patterns. |
| Data-Flow Discussion | Data Governance | Available on request | Mapping data paths, transformation boundaries, and output destinations. |
| Integration Planning | Systems Engineering | Available on request | Reviewing ERP, CRM, database, and API connector specifications. |
| Role & Access Model Discussion | Access Control | Available on request | Designing role-based access, permission tiers, and approval boundaries. |
| Retention & Deletion Requirements | Data Lifecycle | Available on request | Defining data retention policies, archiving rules, and deletion protocols. |
| Acceptance Criteria & Test Planning | Quality Assurance | Available on request | Structuring UAT scripts, edge-case testing, and sign-off benchmarks. |
| Integration Boundaries | Systems Engineering | Configured per project | Strict scoping of read/write permissions to client source systems. |
| Access-Control Requirements | Access Control | Configured per project | Tailored SSO, MFA, and multi-tenant isolation configurations. |
| Validation Workflow | Quality Assurance | Configured per project | Automated formula checks, line-item verification, and threshold alerts. |
| Review & Approval Process | Human Governance | Configured per project | Custom multi-step approval workflows for commercial or operational outputs. |
| Audit & Evidence Expectations | Evidence Lineage | Configured per project | Configurable line-item audit logs and source citation lineage. |
| Monitoring & Support Requirements | Operations | Configured per project | SLA definitions, error logging, and operational support channels. |
| Formal Security & Compliance Roadmap | Roadmap | Planned | Ongoing alignment with emerging global security and governance frameworks. |
Discovery Security Questionnaire
Detailed security review documentation for enterprise procurement teams.
Deployment Architecture Discussion
Technical evaluation of cloud, hybrid, or VPC deployment patterns.
Data-Flow Discussion
Mapping data paths, transformation boundaries, and output destinations.
Integration Planning
Reviewing ERP, CRM, database, and API connector specifications.
Role & Access Model Discussion
Designing role-based access, permission tiers, and approval boundaries.
Retention & Deletion Requirements
Defining data retention policies, archiving rules, and deletion protocols.
Acceptance Criteria & Test Planning
Structuring UAT scripts, edge-case testing, and sign-off benchmarks.
Integration Boundaries
Strict scoping of read/write permissions to client source systems.
Access-Control Requirements
Tailored SSO, MFA, and multi-tenant isolation configurations.
Validation Workflow
Automated formula checks, line-item verification, and threshold alerts.
Review & Approval Process
Custom multi-step approval workflows for commercial or operational outputs.
Audit & Evidence Expectations
Configurable line-item audit logs and source citation lineage.
Monitoring & Support Requirements
SLA definitions, error logging, and operational support channels.
Formal Security & Compliance Roadmap
Ongoing alignment with emerging global security and governance frameworks.
Privacy & Public-Site Guidance
Public website demonstrations use illustrative or synthetic data. Do not submit confidential information through the public website, assessment or Copilot. Final data-handling arrangements are agreed during discovery and documented in the approved project scope.
Request Security Information
Request the Velyx OS Client Security Pack, Architecture Dossier, or Security Questionnaire under appropriate confidentiality terms. Contact: security@velyx.ai.