Security

Written plainly, including the parts that are not impressive yet.

Where the software runs

Extraction runs inside your network, on hardware you control. We do not require a tunnel into your systems, and we do not host a copy of your environment. The output of the extraction is what travels, not access to the source.

What it can access

Read access, scoped to the systems and date ranges named in the agreement. It does not write, and it does not need an administrator account for the business. Anything you exclude in the agreement is excluded before extraction runs, not filtered afterwards.

How output is transmitted and stored

De-identified output is encrypted in transit. It is held only as long as needed to package and deliver it to the buyer named in your agreement, and we do not keep the identifying material because it never reaches us in the first place.

Retention and deletion

Retention is set out in section 8 of our Privacy Policy. In short: enquiries that do not go forward are kept for up to 24 months unless you ask us to delete them sooner, and relationships we are working with are kept for as long as contracts, payment and tax require.

Staff access

Access is limited to the people who need it to do the work, and removed when they no longer do. We are a small team, which means fewer people touch anything, and it also means we have less formal separation of duties than a large vendor. Both are true and you should weigh both.

If something goes wrong

If we become aware of a security incident affecting your data, we will tell you without unreasonable delay, tell you what we know and what we do not yet know, and follow whatever notification obligations the agreement and the law impose. We would rather tell you early and be wrong about the scope than tell you late.

To report a vulnerability or something that looks wrong, email support@joinvellum.com and put "Security" in the subject line. We will acknowledge it.

Certifications

We do not hold SOC 2, ISO 27001 or any comparable certification, and we are not going to imply otherwise. If a certification is a requirement for you, tell us on the call and we will be straight about where we are rather than wasting your time.