SecurityData handling
Plain answers about how your files are handled.
Title files and interconnection packages are sensitive professional material. This page describes our handling rules in plain language. If your counsel needs specifics we have not covered, write to hello@velcore.ai and a human answers.
Your documents are processed for you
Files submitted to ClearFile or GridLens are processed to produce your deliverable and for no other purpose. We do not train shared models on your documents. Correction data improves the instance that serves you; any broader use requires an explicit, priced data-rights agreement.
Encryption in transit and at rest
All traffic to and from Velcore systems is encrypted in transit with TLS. Document stores and databases are encrypted at rest. Credentials for connected accounts are stored using envelope encryption, never in plaintext.
Isolation between clients
Each client workspace is logically isolated. Document processing runs in scoped jobs that cannot read across workspaces, and outputs, including citation stores and correction histories, are partitioned per client.
Access control and least privilege
Access to client data is role-based and least-privilege by default. Engineers do not browse client files: production access is purpose-scoped, logged, and reviewed. In the products themselves, administrators scope exactly who sees which workspace and which module.
Audit trails on every action
For Velcore OS, every agent draft, human approval, rejection, and edit is logged with actor, timestamp, and diff. The same discipline applies to our document products: every claim in a deliverable traces to its source, and every review action traces to its reviewer.
Retention and deletion
Client documents are retained for the life of the engagement and the applicable professional record window, then deleted on written request. When a data-rights agreement covers redacted artifacts, only explicitly redacted, contractually approved material persists beyond deletion.
Subprocessors, named and bounded
We run on major cloud infrastructure and model providers, chosen for their enterprise data terms, including no-training guarantees on API inputs. A current subprocessor list is available on request, and material changes are announced before they take effect.
Human review is a security control
The most important guarantee is structural: nothing leaves for a client, an official record, or a study submission without a named human approving it. The system is built to make review fast and verifiable, not to remove the reviewer.
What we will never claim
Security pages lose credibility when they over-promise. Two honest limits: no system eliminates risk, and no AI output replaces licensed review. We design for both instead of denying them, and we would rather answer a hard question than win a fast signature.
Start
Send security questions to a human.
Questionnaires, E&O posture, data-rights terms, subprocessor lists: ask and you get a written answer from the people who built the system.