Security that ships in the product, not just on this page
Velsano holds your customer relationships — health, revenue, conversations. That data deserves specifics, not adjectives. This page lists what the product actually does to protect it, how AI access is governed, exactly which vendors process data on our behalf, and how to reach us about a vulnerability.
Authentication & identity
- Hardened sign-in — Passwords are bcrypt-hashed and never stored or logged in plaintext, with automatic account lockout after repeated failed attempts.
- Short-lived sessions — Access tokens are short-lived JWTs paired with an httpOnly, rotating refresh cookie. Deactivating a user cuts their ability to refresh immediately.
- Single sign-on — SAML 2.0 and OIDC per workspace. Admins can enforce SSO so password login is disabled entirely, and identity-provider secrets are encrypted at rest with AES-256-GCM.
- Multi-factor authentication — TOTP-based MFA (RFC 6238) with one-time recovery codes; shared secrets are encrypted at rest.
- SCIM provisioning — Automatic user provisioning and deprovisioning from your identity provider, authenticated per workspace — offboarding in your IdP is offboarding in Velsano.
Tenant isolation & access control
- Isolation at the data layer — Every workspace is isolated by tenant. The data-access layer applies the tenant boundary to every query automatically, and an automated cross-tenant probe suite verifies that isolation on an ongoing basis.
- Defense-in-depth, stated honestly — A database-level row-security policy is designed and proven by automated test as an additional layer. Production isolation is enforced at the application layer today — we say that plainly rather than implying more.
- Role-based access control — Permission groups gate every feature and record operation. Record visibility can be further scoped by ownership, territory, and your coverage model.
- IP allowlisting — Workspaces can restrict access to trusted networks with a per-workspace IP allowlist.
Encryption & data protection
- Encryption in transit — TLS on every public endpoint — marketing, app, API, and portal.
- Encryption at rest — Managed-Postgres storage encryption, plus application-layer AES-256-GCM on the most sensitive fields: connector credentials, SSO client secrets, and MFA secrets.
- Encrypted backups — Nightly database backups are encrypted and stored off-platform, separate from the primary database.
- No public file URLs — Attachments are streamed through the API behind authentication and tenant checks — we do not hand out presigned storage URLs.
- Secrets hygiene — Secrets live in environment configuration, never in code, and the service refuses to boot in production with missing or weak secrets.
Auditability & change management
- Full audit log — Security-sensitive changes are recorded with actor, IP address, and source. Sensitive values are redacted before they are written, retention is configurable with a high compliance floor, and the log is viewable in-app and exportable to CSV.
- Scoped API keys — API keys are minted by admins, carry per-key scopes, are revocable at any time, and every API and MCP call is logged.
- Change management — Every code change ships through pull-request review with automated tests in CI.
AI governance
- You control what AI can see — Per-workspace governance lets admins deny specific AI tools and data objects. The denylist applies to every AI surface — copilot, agents, and the MCP server alike.
- Human-in-the-loop by default — Agents propose; your team approves from the Agent Inbox. Autonomous sending is opt-in, restricted to allowlisted topics, health-gated, send-capped, quiet-hours aware — and fails closed.
- Prompt-injection defense — Untrusted customer content — emails, transcripts, tickets — is fenced and sanitized before it ever reaches a model prompt.
- One governed model gateway — All LLM traffic flows through a single gateway to Anthropic, with per-workspace usage metering and kill switches. Embeddings (off by default) flow through a single gateway to OpenAI. There are no shadow AI calls.
Data lifecycle
- Retention you control — Automated per-workspace retention anonymizes raw free-text — transcripts, email bodies — past your configured threshold and deletes old raw ingest events, while preserving the derived, non-personal aggregates your reporting needs.
- Deletion on request — Workspace admins can trigger complete erasure with an explicit confirmation step. The purge is derived from the data model itself, so nothing is silently left behind.
- A recycle bin for mistakes — Accidental in-app deletions land in the Trash first, where admins can restore them before permanent cleanup.
Subprocessors — who touches your data, and why
Velsano runs on a small, named set of infrastructure and service providers. This is the complete list of vendors that process data as part of operating the platform:
| Vendor | Purpose | What it processes |
|---|---|---|
| Vercel | Frontend hosting (marketing site and app shell) | Web traffic |
| Railway | API hosting | Application traffic in transit |
| Neon | Managed PostgreSQL (primary database) | Workspace data at rest, storage-encrypted |
| Cloudflare R2 | File attachments and encrypted backups | Uploaded files; encrypted backup archives |
| Anthropic | All LLM features, via a single governed gateway | The specific account context a feature needs, governed by your AI controls |
| OpenAI | Text embeddings for semantic search — off by default, per-workspace opt-in | Text selected for embedding, only if enabled |
| Resend | Transactional and program email delivery | Recipient addresses and email content |
| Stripe | Subscription billing | Billing contact and subscription details — card data never touches Velsano |
| Sentry | Error monitoring (optional) | Error traces with secrets scrubbed |
Integrations you enable are different
Connectors — Salesforce, HubSpot, Google, Zendesk, Jira, Slack, Zoom, SAP BDC, Databricks, Snowflake, S3/SFTP and others — exchange data only for your workspace, only after one of your admins connects them, with credentials encrypted at rest. They are opt-in integrations under your control, not always-on subprocessors.
Responsible disclosure
Found a vulnerability? We want to hear about it. Email us with enough detail to reproduce the issue; we will acknowledge quickly, keep you informed while we fix it, and credit you for the find if you would like. Contact: support@velsano.ai
Frequently asked questions
- Is my data isolated from other customers?
- Yes. Every query runs behind a tenant boundary applied automatically at the data-access layer, and an automated cross-tenant probe suite verifies that isolation. A database-level row-security policy is additionally proven by automated test as defense-in-depth, with production isolation enforced at the application layer today.
- What does the AI see, and can we control it?
- Only what you allow. Admins can deny specific AI tools and data objects per workspace, and the denylist applies to every AI surface including the MCP server. Agents propose actions for human approval, untrusted content is fenced before it reaches a model, and all LLM traffic flows through one governed, metered gateway.
- Can we delete our data?
- Yes. Retention policies anonymize raw free-text past your configured threshold automatically, and workspace admins can trigger complete erasure with an explicit confirmation step — the purge is derived from the data model so nothing is left behind. Accidental in-app deletions are recoverable from the Trash first.
- Where does my data live?
- Primary data lives in managed PostgreSQL (Neon) with storage-level encryption; attachments and encrypted nightly backups live in Cloudflare R2. The subprocessor table above is the complete list of vendors that process data on our behalf.