Security

Last updated 29 August 2026

This Security page describes how Vevesh protects folder-native knowledge AI used by lawyers, engineers, scientists, researchers, and consultants who require traceable, citation-grounded answers. It supplements our Privacy Policy and Terms of Service.

Vevesh is in active private preview. Certifications and formal audit reports are rolled out with enterprise design partners; contact us for current status letters.

1. Security principles

  • Isolation by default — customer knowledge bases live in dedicated data planes separate from marketing and operational tooling.
  • Zero retention design goal for customer corpora used in model training pools.
  • Least privilege for operators and team RBAC for tenants.
  • Citation traceability — every grounded claim should map to an indexed artifact.
  • Hybrid deployment — local indexing, optional server extraction, self-hosted server path.

2. Architecture overview

2.1 Planes of operation

  • Desktop client — local filesystem access, local extraction, optional offline RAG.
  • Managed sync — derived chunks and embeddings for team knowledge bases.
  • Edge pipeline — server extraction for vision-heavy or batch workloads when enabled.
  • Postgres — accounts, billing, RBAC, KB settings (not your source tree).

2.2 Blast-radius reduction

Marketing websites, operational workers, and customer KB storage use separate infrastructure accounts. A compromise in public marketing surfaces must not expose indexed customer corpora.

3. Encryption and secrets

  • TLS 1.2+ for data in transit between clients, APIs, and external AI Providers.
  • Encryption at rest for stored index artifacts and database volumes.
  • API keys and provider credentials stored outside client bundles; rotated on policy.
  • Team bridge tokens and membership caches invalidated on role changes.

4. Access control

  • Team roles: owners, members, project-level allowedGlobalRagIds restrictions.
  • Ghost vs open citation modes for consultant deliverables.
  • Administrator-configured model lanes and cost ceilings.
  • Operator access to production limited to personnel with business need; logged.

5. Application security

  • Secure development practices, dependency review, and environment separation.
  • Input validation on upload and sync endpoints; size limits per KB policy.
  • Rate limiting and abuse detection on authentication and inference routes.
  • Periodic vulnerability assessment; results shared with enterprise partners under NDA.

6. AI-specific controls

  • Context minimization — retrieval packs scoped to query and permitted KBs.
  • Verification loops flag contradictions before answers reach deliverables.
  • Tool-calling orchestration (LangGraph) with metered limits during preview.
  • External AI Provider traffic follows privacy tiers configured by your administrator.
  • Speech-to-text (Groq Whisper lane where enabled) processed for transcription only.

7. Incident response

We maintain an incident response process covering detection, containment, eradication, recovery, and customer notification. For incidents affecting Customer Data, we notify affected design partners without undue delay and describe scope, impact, and remediation steps.

  • Designated security contact: helloo@vevesh.com (subject "Security incident").
  • Target acknowledgement for critical reports: five business days during preview.

8. Responsible disclosure

We welcome good-faith security reports from researchers and customers. Do not test against knowledge bases you do not own. Do not perform denial-of-service attacks against production.

  • Email helloo@vevesh.com with subject "Security disclosure".
  • Include reproduction steps, CVSS estimate if known, and affected component URLs.
  • Allow reasonable time to remediate before public disclosure; we will credit researchers who request it.
  • We do not pursue legal action against researchers who comply with this policy.

9. Compliance and questionnaires

Enterprise design partners may request security questionnaires, subprocessor lists, and architecture diagrams under NDA. Vevesh aligns controls with common SOC 2 Type II and ISO 27001 expectations; formal certification timelines are shared during procurement.

  • GDPR/UK GDPR: DPA available on request.
  • HIPAA: not offered by default; regulated health data requires separate assessment.
  • Legal privilege and client confidentiality: configure ghost modes and deployment boundaries with your counsel.

10. Subprocessors (categories)

  • AI Providers you enable: OpenAI, Anthropic, Google, Groq, Moonshot AI, DeepSeek, xAI, Qwen, MiniMax, GLM.
  • Payment: Stripe.
  • Infrastructure: hosting, object storage, vector indexes, edge workers (current vendor list on request).
  • Email and transactional notifications.

11. Data residency

Default regions depend on deployment choice during onboarding. Self-hosted server deployment can keep primary processing on your hardware. Contact us for EU-only or air-gapped architecture discussions.

12. Security contacts

General security inquiries: helloo@vevesh.com — subject "Security inquiry".

Vulnerability reports: helloo@vevesh.com — subject "Security disclosure".

Include organization name, deployment mode (cloud / hybrid / self-host), and frameworks you need addressed.