Security

Customer Data is stored and processed on infrastructure in the European Union: Amazon Web Services in Frankfurt, Google Cloud in Belgium, Vercel in Frankfurt and Stockholm, and Supabase on Amazon Web Services in Frankfurt. These providers hold SOC 2 Type II reports and, where they hold it, ISO/IEC 27001 certification. Model inference runs in EU regions where the provider offers them; otherwise it runs under the Standard Contractual Clauses, as Annex 3 of the Data Processing Agreement lists provider by provider. The connections to the Google services that a brand links are handled by Composio in the United States, under the Standard Contractual Clauses.

• Encryption in transit with TLS 1.2 or higher, and at rest with AES-256.
• Daily backups and redundancy across availability zones. Availability is monitored from at least two locations in the European Union.
• Least-privilege access with multi-factor authentication, logged. The credentials of the software a brand connects are stored encrypted.
• Each brand’s data is separated by tenant, so that each brand’s account reaches only that brand’s data, and the models, prompts and knowledge Veliu derives for a brand serve that brand alone.
• Vulnerability management and an incident response process. We notify affected customers of a personal data breach without undue delay and within 72 hours of becoming aware of it.

Customer Data serves the brand it belongs to. Veliu improves its own models only with Telemetry, meaning aggregated or de-identified measurements that name no brand and no person, as Section 4.4 and Section 4.6(c) of the Master Subscription Agreement define. The third-party model providers we use work under enterprise terms that do not allow them to train on Customer Data. Section 4.6 of the Master Subscription Agreement and Section 11 of the Data Processing Agreement state this in full.

The subprocessors that process Customer Data, their purpose and their location are listed in Annex 3 of the Data Processing Agreement. We give customers at least thirty days’ notice of any change, and they may object.

If you believe you have found a security vulnerability in Veliu’s services or website, write to legal@veliu.com with the details needed to reproduce it. We acknowledge within two working days in Ireland and keep you informed of the fix. Testing the security of our systems, including scanning or load testing, requires our prior written authorisation, as the Acceptable Use Policy sets out.