TLS 1.3 everywhere
Every call to the API and every replication hop between nodes is encrypted. Older suites are refused rather than downgraded.
Trust
Your vectors, and nobody else's
An embedding is derived from your content. We treat it as your content — encrypted, isolated, and never used for anything you did not ask for.
Posture
Four guarantees, stated plainly
AES-256 on every volume
Vectors, metadata and snapshots sit on encrypted volumes. Keys rotate on a 90-day cycle, and a per-tenant key is available on the Scale tier.
One namespace, one tenant
Indexes are scoped to a namespace that carries its own credentials. A query can never cross a namespace boundary, by construction rather than by filter.
Scoped keys, short lives
API keys carry read, write or admin scope and can be limited to a single index. Rotation is immediate and never interrupts in-flight queries.
Compliance
Where we actually stand
Including the one we do not cover. A gap you know about is cheaper than one you discover in procurement.
| Framework | Status | Detail |
|---|---|---|
| SOC 2 Type II | Audited annually | Report available under NDA |
| GDPR | Compliant | DPA and sub-processor list on request |
| ISO 27001 | In progress | Target: Q4 |
| HIPAA | Not covered | Do not store PHI on the platform |
Operations
How we work
Least privilege by default
Engineers hold no standing access to customer data. Production access is requested, time-boxed, approved by a second person and logged.
Backups you can actually restore
Snapshots every six hours, retained 30 days, in a separate region. Restores are rehearsed quarterly — an untested backup is not a backup.
Dependencies watched, not hoped for
Automated vulnerability scanning on every build, with a 48-hour patch window for anything rated high or critical.
Disclosure without friction
Report a vulnerability and you get a human reply within one business day, a fix window agreed in writing, and credit if you want it.
Questions
The ones that decide
Where are my vectors stored?
In the region you pick at index creation, and nowhere else. Replication stays inside that region unless you explicitly enable cross-region backup.
Do you train anything on my data?
No. Your vectors and metadata are never used to train, tune or evaluate any model, ours or anyone else’s. That is a contractual commitment, not a setting.
What happens when I delete an index?
It stops serving immediately and is purged from primary storage within 24 hours. Encrypted snapshots roll off within the 30-day retention window.
Can I get a DPA?
Yes, on any paid plan. Write to contact@vela.dev and we send it the same day.
How do you handle an incident?
Affected customers are notified within 24 hours of confirmation, with what happened, what was reached, and what we changed. A written post-mortem follows within five business days.
Review
Send us your security questionnaire
We answer vendor assessments in full, in writing. Most come back within two business days.