Independently audited. Built for teams whose job is to ask these questions.
Explore our controlsWhat we can share publicly, and how to request restricted evidence.
INDEPENDENT AUDIT
Audited by A-LIGN against the Trust Services Criteria.
Available to qualified customers and prospects under NDA, following manual approval.
CERTIFICATION
Certified by BSI.
The certificate is not published publicly. Please contact Veleta to enquire about the certificate.
INDEPENDENT TESTING
Tested by Prescient Security.
Independent third-party penetration testing every six months.
Findings are tracked through remediation and retested to verify resolution.
LEGAL FRAMEWORK
Veleta processes customer data as a processor under Article 28 GDPR, governed by a Data Processing Agreement.
The DPA is available on request. Read the full privacy and data protection section for roles, retention, erasure requests and data location.
Veleta's controls are also mapped to NIS2 and DORA ICT third-party requirements.
Controls are described in plain language, with the scope and limits made explicit.
Veleta uses Amazon Web Services (AWS) infrastructure for tenant upload and evidence storage. Replit hosts the published application.
Data in transit is protected using TLS/SSL with trusted server certificates. AES-256 is used for protected data at rest.
Backup processes are monitored daily. The environment uses replication across availability zones and object versioning and recovery mechanisms. Backup restoration and disaster-recovery testing are performed at least annually.
Recovery time and recovery point objectives are defined and tested. RTO: 2 hours. RPO: 1 minute. These are recovery objectives, not guaranteed uptime or an automatic SLA credit policy.
Veleta applies role-based access control, least privilege, formal access approval, periodic access reviews and documented revocation procedures. Permissions and access-control lists limit access according to business need.
Internal identity and access management uses JumpCloud alongside Google Workspace identity services. Access to critical internal systems uses multi-factor authentication. These internal controls are distinct from customer-facing product authentication capabilities.
In the product, company administrators can configure SAML 2.0 single sign-on (SSO) with a complete, active identity-provider configuration and manage permitted sign-in methods. Access inside a customer workspace is role-based and managed by the customer's administrators. Users can enable MFA for password sign-in. For SAML, Google and Microsoft sign-in, MFA is managed by the identity provider under its own configuration and policies.
Customer data is logically separated per tenant. Every request is authorised against the tenant it belongs to, and one customer's data is not accessible from another customer's workspace.
Departures and role changes trigger prompt revocation or reassignment of access. Lost or compromised authentication tokens are revoked.
Administrative and security-relevant actions are logged. Infrastructure audit logging includes AWS CloudTrail; application audit logs record security-relevant account and permission changes.
For customer-supplied personal data processed on customer instructions in connection with the service, Veleta acts as processor and the customer as controller, subject to the applicable DPA. Veleta may separately act as controller for limited business-administration, account, security or compliance data. The DPA governs the parties’ roles and obligations.
The DPA is available to customers and qualified prospects on request. Veleta's DPA is based on Article 28 GDPR and forms part of the customer agreement.
Veleta uses sub-processors to deliver the service. The current list is published below.
Customers are notified in advance of intended subprocessor additions or replacements and may object as set out in the DPA.
Customer data is stored in the European Union (EU), including customer data processed by all subprocessors listed below.
Customer data is retained for the duration of the agreement, and customers can export their data before termination. On the applicable termination or valid erasure trigger, Veleta deletes customer data without undue delay from production systems and backups in accordance with the applicable agreement and retention policy, except where retention is required by law. Removing a user's workspace access is separate from customer-data deletion.
Veleta assists customers in responding to data subject requests — access, rectification, erasure, restriction, portability and objection. Requests received directly by Veleta that concern customer data are forwarded to the relevant customer without undue delay.
Veleta notifies affected customers of personal data breaches without undue delay and within 24 hours of Veleta becoming aware of the breach, with the information needed to meet their own notification obligations.
Data protection is considered in the design of new features. Veleta maintains records of processing activities and carries out data protection impact assessments where required.
Automated vulnerability scanning is performed weekly. Findings are evaluated and remediation is tracked, including retesting where appropriate.
A formal patch-management process evaluates, tests and deploys security updates. Significant releases and patches are tested in staging/QA before production deployment.
Source changes are maintained in version control. Production changes follow change-management and approval procedures.
A documented incident response process covers detection, triage, containment, remediation and post-incident review. Customers are notified of security incidents affecting their data in accordance with contractual and DPA obligations. Affected customers are notified of personal data breaches without undue delay and within 24 hours of Veleta becoming aware of the breach.
All personnel complete security and privacy awareness training at onboarding and annually. Personnel are bound by confidentiality obligations, and background checks are performed where permitted by local law.
Suppliers with access to customer data or production systems are assessed before onboarding and reviewed annually against Veleta's security and privacy requirements.
Third parties that process customer data on Veleta's behalf, and why.
| Subprocessor | Purpose | Data processed | Customer-data location | Website |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Tenant upload and evidence storage. | Uploaded documents, evidence and file metadata. | European Union (EU) | AWS |
| OpenAI | AI-assisted document extraction, questionnaires and assessment analysis. | Document text/images, questionnaire questions and answers, assessment and vendor content submitted for AI analysis. | European Union (EU) | OpenAI |
| Resend | Transactional email delivery when configured. | Recipient email addresses, names, company details and message content, including invitation and workflow links. | European Union (EU) | Resend |
| Paddle | Checkout, billing and subscription management. | Billing contact/email, company and subscription identifiers, purchased modules, seat quantities and transaction details. | European Union (EU) | Paddle |
| Optional Google sign-in; optional Google Calendar integration only when connected. | Sign-in identity, email and profile details; connected calendar identifiers, event titles/descriptions, dates and locations. | European Union (EU) | ||
| Microsoft | Optional Microsoft sign-in when configured. | Identity, email and profile details retrieved through Microsoft Graph. | European Union (EU) | Microsoft |
| PostHog | Product analytics after analytics consent; autocapture and session recording can then be enabled. | Interaction/page events, account identifiers and name/email/role/company profile properties for signed-in users; captured interactions and session recordings with input masking configured after consent. | European Union (EU) | PostHog |
OpenAI: Customer data is not used to train models. OpenAI's provider retention is separate from Veleta's retention and deletion policy; provider retention details are available on request.
Last updated:
Customers are notified in advance of intended subprocessor additions or replacements and may object as set out in the DPA.
Security capabilities available inside the Veleta product, as distinct from Veleta's internal controls.
Workspace administrators can configure their organisation's SAML identity provider. SAML sign-in requires a complete, active configuration.
Workspace administrators can manage permitted sign-in methods. Google and Microsoft sign-in are available where the provider is configured and the account or organisation permits it.
Users can enable MFA for password sign-in. For SAML, Google and Microsoft sign-in, MFA is managed by the identity provider under its own configuration and policies.
Workspace permissions distinguish read-only access, everyday work and administration, with access limited to the appropriate organisation and responsibilities.
Standard account sessions have a fixed expiry. Users can end their sessions by logging out.
Workspace administrators can remove a user's access to their workspace. Data retention, export and erasure requests follow the separate privacy process. Retention and deletion
TLS/SSL protects data in transit, and AES-256 protects data at rest. Hosting, encryption and recovery
Recovery objectives, backups and how incidents are communicated.
Documents available publicly or under NDA.
When reporting suspected vulnerabilities, include the affected system, steps to reproduce and any supporting evidence.
Testing is limited to systems explicitly authorised in writing or a dedicated Veleta sandbox. The public shared product demo is not permission to conduct security testing.
Researchers must not access other users’ data, intentionally disrupt service availability, conduct social engineering, perform denial-of-service testing or test third-party infrastructure without authorisation.
Veleta supports good-faith security research intended to improve the security of our services. If you comply with this policy, make a good-faith effort to avoid privacy violations, disruption of services, destruction or modification of data, and access beyond what is reasonably necessary to demonstrate a vulnerability, Veleta will not pursue legal action solely in response to your security research. If you encounter customer or personal data, stop testing, do not retain or distribute the data, and report the issue to us promptly.
This safe harbour does not authorize testing against third-party services or activities prohibited by applicable law.
A sandbox is intended for product evaluation and approved functional/security validation. Security testing must remain within the requesting organisation’s own authorised sandbox tenant and test data.
Unless Veleta provides written authorisation, do not scan production systems; perform denial-of-service, load, stress or resource-exhaustion testing; conduct credential stuffing, password spraying, phishing or social engineering; access another customer’s tenant or data; exfiltrate, modify or destroy data; test third-party services or integrations; or run automated tools at a volume that may affect availability.
Obtain written approval before broader testing begins.
Explore the shared product demo For evaluation only — not for security testing.Answers based on the controls and evidence available here.
The 5 September 2026 report covers 1 September 2025–31 August 2026. It may be provided to qualified customers and prospects under NDA, following manual approval.
Veleta uses Amazon Web Services (AWS) infrastructure for tenant upload and evidence storage. Replit hosts the published application. Customer data is stored in the European Union (EU), including customer data processed by all subprocessors listed below.
Privacy and data protectionThe public subprocessor list describes the service providers, their purposes and the customer data they process, including optional integrations.
View the subprocessor listReport vulnerabilities to security@veleta.pro. Follow the responsible-disclosure policy and obtain written approval for broader testing.
security@veleta.proYes. Veleta can complete reasonable customer security questionnaires for qualified customers and enterprise prospects. Start with this Trust Center and the standard evidence package. Sigma is Veleta’s questionnaire workflow, not an automatic commitment to complete every request.
Explore the Sigma questionnaire workflowThe shared product demo is available for evaluation, not security testing. Security validation requires an explicitly authorised dedicated tenant and your own test data. Follow all sandbox testing restrictions and obtain written approval before broader testing.
Explore the product demoGood security starts with clear answers.
See how Veleta works