VectorAmp / Security

Security claims should be boringly true.

VectorAmp is early, technical, and honest about the controls we can stand behind. This page summarizes our current security posture without inventing certifications, offices, reports, or compliance programs.

HTTPSAWS-MANAGED INFRATENANT CONTEXTLEAST PRIVILEGE
[ 01 — Pillars ]

Three things we refuse to fake.

Security pages are easy to overstate. We keep the promise narrower and make the engineering better.

P · 01

Customer data is scoped to the customer.

Organizations, datasets, source records, API keys, and queries carry tenant context. The application and retrieval layers are built around those boundaries.

  • ✓Organization-scoped workspaces and API keys
  • ✓Dataset ownership enforced through backend APIs
  • ✓Shard routing and retrieval requests include tenant context
  • ✓Access checks belong server-side, not in browser state

VectorAmp enforces organization and dataset boundaries at the platform level. Customers remain responsible for the permissions they configure, including access delegated to third-party contractors or agents. VectorAmp is not liable for losses arising from permissioned access to datasets granted incorrectly by a client or its contractors.

P · 02

Infrastructure uses managed cloud controls.

VectorAmp runs on AWS-managed infrastructure and uses standard cloud controls for identity, networking, storage, logging, and encryption.

  • ✓HTTPS for public application traffic
  • ✓Encryption at rest through managed storage services
  • ✓Secrets and runtime config supplied through deployment env
  • ✓Production changes flow through repositories and manifests
P · 03

Operational access should be limited and logged.

We design operations around least privilege, clear ownership, logs, and reproducible deployment paths. Manual infrastructure changes are avoided.

  • ✓Least-privilege access for services and operators
  • ✓Logs for debugging, abuse prevention, and incident response
  • ✓Repository-backed changes for application and infrastructure config
  • ✓Security reports routed through the contact form
[ 02 — Data handling ]

Designed for governed retrieval.

What VectorAmp stores and processes.

Customers connect or upload data, and VectorAmp processes that data into source records, chunks, embeddings, indexes, query results, and citations. The system is designed so those records stay attached to the owning organization and dataset.

While VectorAmp enforces tenant boundaries at the platform level, customers are responsible for correctly configuring dataset-level permissions for all users and third-party contractors they grant access to.

We use customer content to provide the product: ingestion, search, retrieval, citations, workflow generation, support, debugging, safety, and reliability. We do not use customer content to train shared foundation models.

Traffic
HTTPS
Storage
Managed encryption
Tenancy
Org + dataset scope
Training
No shared-model training on customer content
[ 03 — Current controls ]

Current posture, in plain English.

We do not publish unverified certification badges, audit-report claims, regulated-workload promises, or authorization timelines. When a compliance claim is real and approved, we can say it plainly.

SOC 2 Type II in progressHIPAA in progress
TLS
Encryption in transit
Standard control

Public traffic is served over HTTPS. Service-to-service traffic is designed to stay inside private network paths where possible.

KMS
Encryption at rest
AWS-backed

Customer content is stored in managed infrastructure with encryption at rest, access controls, and scoped service permissions.

IAM
Least privilege
Operational control

Production access is scoped to operational need. Secrets and credentials are managed through environment and cloud identity controls.

TEN
Tenant boundaries
Product design

Organizations, datasets, API keys, and query requests carry tenant context through the application and retrieval layers.

AUD
Logging and monitoring
Active

Application and infrastructure logs are used for debugging, abuse prevention, incident response, and reliability work.

DPA
Data processing
On request

We can discuss data-processing terms and subprocessor details during procurement. We do not publish claims for certifications we do not yet hold.

[ 04 — Response ]

When something looks wrong.

How to send useful security reports.

Use the contact form and select Security. Good reports include the affected asset, account or workspace context if applicable, reproduction steps, expected impact, and whether you accessed data that was not yours.

Please avoid destructive testing, automated scans that degrade service, social engineering, spam, or attempts to access another customer’s data.

  • Report
    Submit through the Security topic on the contact form.
    The backend routes security reports to the security destination without exposing addresses on the page.
  • Triage
    We review severity and reproducibility.
    We may ask for clarification or a safer proof of concept.
  • Contain
    If valid, we scope impact and patch through the normal deployment path.
    Customer notifications depend on actual impact and contractual/legal requirements.

Responsible disclosure.

We welcome good-faith reports. This is not a bounty promise, safe-harbor legal agreement, or permission to test beyond your own account. If you are unsure, ask first through the contact form.

  • Test only against accounts, workspaces, and datasets you control.
  • Do not exfiltrate, modify, or delete data that is not yours.
  • Do not run denial-of-service, spam, credential-stuffing, or social-engineering tests.
  • Give us a reasonable window to investigate before public disclosure.
  • Include enough detail for us to reproduce the issue safely.
Do you train shared models on Customer Data?+

No. Customer content is processed to provide the service, not to train shared foundation models.

Where is data hosted?+

VectorAmp runs on AWS-managed infrastructure. Region and deployment requirements should be discussed during onboarding or procurement.

Can VectorAmp support private or dedicated deployments?+

For enterprise workloads, we can discuss deployment shape, network isolation, and operational requirements case by case.

Which compliance materials can I request?+

Use the contact form for procurement-specific security or compliance questions. We only advertise certifications, attestations, business associate agreements, or authorization roadmaps after they are verified and approved.

How should I report a vulnerability?+

Use the contact form and choose the Security topic. Include affected URL/API, repro steps, impact, and any proof-of-concept details.