Trust Center

Assurance

• SOC 2

  Pending

  SOC 2 is pending. We will share the report under a confidentiality agreement when it is ready.

• Penetration test

  An independent firm will perform a penetration test at least once a year. We will complete the first test within 90 days after the production environment first hosts Customer Data. We will share a summary on request after that test.

• Questionnaires

  We will complete a SIG Lite or CAIQ questionnaire on request, at no charge.

Under a nondisclosure agreement

• Architecture and data flow
  Request documents ->
• Access control matrix
  Request documents ->
• Incident response plan
  Request documents ->

• Amazon Web Services, Inc.

  This provider hosts and stores the production environment.

  United States

  Customer Data receivedThis provider receives all Customer Data, encrypted at rest.

• Anthropic, PBC

  This provider runs language model inference for the assisted extraction tier. The contract requires that this provider does not keep a copy of your data and does not train models on it.

  United States

  Customer Data receivedFrom 15 October 2026, this provider will receive contract pages and scanned documents only.

• Vercel Inc.

  This provider hosts the customer-facing web application.

  United States

  Customer Data receivedThis provider does not store Customer Data. It receives request metadata while a request is in transit.

• Access

  • We connect with read-only access to the systems you choose, and we use the smallest scopes each system allows.
  • You set the exclusions. You can revoke access at any time.
  • The people named in your Order Form can see your data. We log every access.
  • Named analysts review candidate findings. Those findings are excerpts with citations. The analysts do not browse mailboxes.

• Encryption and residency

  • By default the Service runs on Amazon Web Services in the United States, in the us-west-2 (Oregon) region.
  • Customer Data stays in the United States unless your Order Form names another region.
  • We encrypt it in transit with TLS 1.2 or higher and at rest with AES-256, in a separate database for your workspace.
  • If you choose a customer-hosted deployment, we keep that data in your own Amazon Web Services account. That includes the index and the graph.
  • We will share the deployment specification on request.

• Use and retention

  • We do not write to your systems.
  • We do not train models on your data unless you grant that in writing. Our model providers' contracts do not allow them to train on your data.
  • We do not keep your data after the engagement ends.
  • We will delete it within 30 days. We will delete backups within 90 days. We will send a certificate on request.
  • We do not share your findings or your name unless you approve that in writing.

Questions we are asked most

Security and privacy: legal@vesara.ai.

Under a nondisclosure agreement

On request we will share the architecture and data flow, the access control matrix, the incident response plan, and an information security policy summary. We will share a penetration test summary after we complete a test. The SOC 2 report is pending, and we will share it when it is ready.

• Architecture and data flow
  Request documents ->
• Access control matrix
  Request documents ->
• Incident response plan
  Request documents ->
• Information security policy summary
  Request documents ->
• Penetration test summaryWe will share this after we complete a test.
  Request documents ->
• SOC 2 reportWe will share this when the report is ready.
  Request documents ->

Public

Customer agreements and policies are listed on the Legal page.

• Legal
  Open ->
• Privacy Policy
  Open ->
• Terms of Service
  Open ->
• Master Subscription Agreement
  Open ->
• Data Processing Addendum
  Open ->
• Subprocessors
  Open ->
• Status
  Open ->

Controls

• Access

  • We connect with read-only access to the systems you choose, and we use the smallest scopes each system allows.
  • You set the exclusions. You can revoke access at any time.
  • The people named in your Order Form can see your data. We log every access.
  • Named analysts review candidate findings. Those findings are excerpts with citations. The analysts do not browse mailboxes.

• Encryption and residency

  • By default the Service runs on Amazon Web Services in the United States, in the us-west-2 (Oregon) region.
  • Customer Data stays in the United States unless your Order Form names another region.
  • We encrypt it in transit with TLS 1.2 or higher and at rest with AES-256, in a separate database for your workspace.
  • If you choose a customer-hosted deployment, we keep that data in your own Amazon Web Services account. That includes the index and the graph.
  • We will share the deployment specification on request.

• Use and retention

  • We do not write to your systems.
  • We do not train models on your data unless you grant that in writing. Our model providers' contracts do not allow them to train on your data.
  • We do not keep your data after the engagement ends.
  • We will delete it within 30 days. We will delete backups within 90 days. We will send a certificate on request.
  • We do not share your findings or your name unless you approve that in writing.

• Incident response

  • We will notify you promptly, and no later than 48 hours after we become aware of a suspected or confirmed incident that affects your data. We will tell you what we know and what we are doing.

• Assurance

  • SOC 2 is pending. We will share the report under a confidentiality agreement when it is ready.
  • An independent firm will perform a penetration test at least once a year. We will complete the first test within 90 days after the production environment first hosts Customer Data. We will share a summary on request after that test.
  • We will complete a SIG Lite or CAIQ questionnaire on request, at no charge.

• Subprocessors

  • The current list and change log are at vesara.ai/subprocessors.
  • We will email your notice address at least 30 days before any change.
  • No subprocessor will receive Customer Data before 15 October 2026.
  • Each model provider's contract requires that the provider does not keep a copy of your data and does not train models on it.

Subprocessors

The current list and change log are at vesara.ai/subprocessors. Full notice of addition or replacement of a subprocessor will be given via email at least 30 days before change. No data will be shared with Subprocessors before October 15, 2026.

• Amazon Web Services, Inc.

  This provider hosts and stores the production environment.

  United States

  Customer Data receivedThis provider receives all Customer Data, encrypted at rest.

• Anthropic, PBC

  This provider runs language model inference for the assisted extraction tier. The contract requires that this provider does not keep a copy of your data and does not train models on it.

  United States

  Customer Data receivedFrom 15 October 2026, this provider will receive contract pages and scanned documents only.

• Vercel Inc.

  This provider hosts the customer-facing web application.

  United States

  Customer Data receivedThis provider does not store Customer Data. It receives request metadata while a request is in transit.

• WorkOS, Inc.

  This provider handles authentication and directory synchronization for customer users.

  United States

  Customer Data receivedThis provider receives user names, business email addresses, and identity provider identifiers.

Change log

• 14 September 2026

  Initial register published with version 1.0 of the Data Processing Addendum

• 18 September 2026

  Register replaced with the subprocessors in Master Subscription Agreement version 1.1. OpenAI removed. Vercel and WorkOS added. No Subprocessor receives Customer Data before 15 October 2026.