HIPAA-ready with signed BAA. PCI scope reduction via certified card injector. SOC 2 controls, with our own Type II readiness assessment underway. GDPR data processing agreement. WCAG 2.2 AA accessible widget. Every compliance requirement covered without a separate vendor.
Velaro handles regulated industries without compromising the conversation experience. Compliance is enforced server-side, not bolted on after the fact.
Every support team eventually has to hold onto something sensitive against a customer record: a password, a PIN, an account-recovery detail the customer gave you so you could help them next time. Vault Fields lets you mark that one Contact field as encrypted, without moving it to a separate system and without losing it from the record your agents already work in.
Vault Fields is available to any Velaro Contacts customer on Compliance Mode, not limited to accounts that also run ticketing. Every account starts with 3 Vault fields.
Customers type sensitive data into chat whether you ask them to or not — a Social Security number, a card number, a bank account. Velaro automatically detects and masks it in real time, across every channel, before it's ever stored.
PII redaction pairs with Vault Fields and SecureForms rather than replacing either: use SecureForms for data that must never touch Velaro's database at all (card numbers), Vault Fields for one sensitive field your agents genuinely need to reference later, and Redaction for freeform text where PII shows up unexpectedly.
Compliance documentation available from your account manager or at sales@velaro.com.
| Framework | What Velaro Provides | Plan |
|---|---|---|
| HIPAA | Signed BAA, AES-256 encryption at rest, TLS 1.3 in transit, 7-year audit log retention, PII scrubbing, optional US-only data residency | Enterprise |
| PCI DSS | Certified card injector integration (Stripe, Clover, Square), card data never stored in Velaro, Velaro removed from PCI DSS scope, scope reduction letter available | Enterprise |
| SOC 2 | Controls operating to SOC 2 Trust Service Criteria, Azure SOC 1/2/3 inherited for the hosting layer, your SIG or CAIQ questionnaire completed directly by our security team, pen test summary, security review document. Our own Type II readiness assessment is underway - no report is claimed until it exists. | Enterprise |
| GDPR | Standard Contractual Clauses (SCC), Data Processing Addendum, EU / UK / Canada data residency options, GDPR-compliant data deletion on request | Enterprise |
| WCAG 2.2 AA | Accessible chat widget, NVDA and JAWS screen reader support, keyboard navigation, high contrast mode, focus management | Business+ |
| PII Redaction / DLP | Automatic detection and masking of SSN, SIN, credit card, CVV, and bank account numbers across chat, email, SMS, tickets, and social; custom regex patterns, per-channel and per-group control, optional AI-assisted pass with BYOK, and an audit log of every redaction | Compliance Starter+ |
Select the Azure region that satisfies your regulatory requirement. Each residency option is an isolated deployment, not a configuration flag.
Enterprise SSO with SAML 2.0 or OIDC. Works with every major identity provider. SCIM provisioning automates user creation and deprovisioning. MFA is enforced at the IdP level — Velaro inherits your organization's authentication policy.
BAA, security review document, pen test summary - and your own SIG or CAIQ questionnaire completed by our security team. Contact sales to request any of it.