How VelorQ protects data, separates tenants, aligns with compliance frameworks, and handles responsible disclosure.
Security is foundational to VelorQ, not an add-on. The VelorQ platform is designed from the ground up for regulated industries — which means tenant isolation, audit logging, and compliance alignment are architectural, not policy-driven. This page summarises our security posture.
Tenant data is isolated at the schema level — not merely via access-control policies that can be misconfigured. Each tenant receives a dedicated vector store namespace, a dedicated fine-tuning boundary, and a dedicated audit trail. Cross-tenant data leakage is architecturally prevented.
Every inter-model exchange across the VelorQ hub passes through KCL protocol stages — classify, validate, anonymise, consent-check, route, and audit-log. Non-classified signals can flow between models; tenant-identifying data does not.
The platform supports multi-region active architecture with automated failover and tenant-isolated recovery paths. Enterprise deployments also support dedicated VPC and private-cloud hosting where required.
VelorQ's architecture is designed to align with the following frameworks. Certifications are pursued in sequence as deployment footprints require:
Internal access to production systems is governed by least privilege, multi-factor authentication, and regular access reviews. Administrative actions on production are logged and auditable. Customer-side access to the platform supports SSO (SAML 2.0 / OIDC), role-based access control, and session policies.
Every model exchange routed through KCL is audit-logged with immutable records including timestamp, classification, tenant identifier, and routing decision. Audit logs are retained per the applicable commercial agreement and can be exported to customer SIEM systems where contractually agreed.
VelorQ maintains documented incident-response procedures covering detection, containment, remediation, communication, and post-incident review. Customer notifications for material security incidents follow the timelines specified in the applicable DPA and applicable law.
We welcome responsible reports of security vulnerabilities. If you believe you have discovered a security issue affecting VelorQ, please contact us at hello@velorq.ai with the subject "Security Disclosure". We request that researchers:
We will acknowledge receipt within two business days and work in good faith to resolve valid reports.
We engage a small set of vetted sub-processors — primarily for cloud infrastructure, email, and operational tooling. A current list is available to customers under NDA. Material changes to the sub-processor list are communicated to customers in advance in accordance with the applicable DPA.
Enterprise customers and serious prospects can request a security package including architecture overview, DPA template, sub-processor list, and current compliance attestations. Email hello@velorq.ai with subject "Security Documentation".
For security disclosures, documentation requests, or questions about our posture, contact us at hello@velorq.ai.
VelorQ · UpLeap Technologies Private Limited
Hyderabad · Telangana · India