Enterprise Security

Built for Enterprise.
Documented. Redundant. Yours to inspect.

Velaro is engineered from the ground up for organizations where security is non-negotiable. Azure-hosted, operating to SOC 2 controls, AES-256 at rest, TLS 1.3 in transit, and a control environment your InfoSec team can actually review - question by question, on your own questionnaire.

SOC 2 Type II
Evidence Gathering — readiness assessment
HIPAA Ready
BAA on Enterprise Plus contracts
PCI Scope Reduction
Tokenized at Level 1 validated processors
Azure-Native
AES-256 · TLS 1.3 · Key Vault
GDPR & CCPA
EU data residency · DPA available
Zero Data Selling
No data sold, shared, or monetized
Request Security Review View SOC 2 Details

Compliance

SOC 2 Type II - Readiness Assessment In Progress

Here is exactly where we are, with nothing rounded up. We operate to SOC 2 Trust Service Criteria today, we are gathering evidence for our own Type II audit, and in the meantime our security team answers your questionnaire directly instead of handing you someone else's PDF.

Layered translucent panels arranged as a shield, representing Velaro's control environment: each layer reviewed, checked, and evidenced.
Evidence Gathering

We are in the evidence-gathering phase of our SOC 2 Type II audit as we complete our move to Velaro's next-generation platform. Our control environment already runs on Microsoft Azure and inherits its SOC 1/2/3 and ISO 27001 attestations for the hosting layer, and we operate to SOC 2 Trust Service Criteria for security, availability, and confidentiality today.

Rather than pointing you to a static report, our security team completes your Security Information Gathering (SIG) questionnaire directly - line by line - so your procurement team gets exact, current answers about our real controls instead of a document written for someone else.

Send your SIG, CAIQ, or in-house questionnaire to security@velaro.com with your organization name and use case. Our security team responds within one business day.

The Azure migration is what makes the evidence trail possible. Our 2025 migration to Microsoft Azure rebuilt the control environment we are now evidencing - native network segmentation, Azure Key Vault for secrets management, centralized audit logging, and geo-redundant storage. The hosting layer inherits Azure's own SOC 1/2/3 and ISO 27001 attestations; the application layer is what our readiness assessment covers.

Trust Services Criteria Covered

Security (CC)

System protected against unauthorized access, both physical and logical. Covers firewalls, WAF, MFA enforcement, and RBAC controls.

Availability (A)

System available for operation as committed. Covers SLA monitoring, incident response, and active-active regional failover architecture.

Confidentiality (C)

Information designated as confidential is protected. Covers tenant isolation, data classification, encryption at rest and in transit.

Processing Integrity (PI)

System processing is complete, valid, accurate, and timely. Covers input validation, audit trails, and error handling controls.

Infrastructure

Azure-Hosted. Multi-Region. Redundant by Default.

Velaro runs entirely on Microsoft Azure, leveraging the same infrastructure trusted by 95% of Fortune 500 companies. Our architecture is designed for zero single points of failure.

Simplified Architecture - Public Reference Document - Not All Components Shown
End Users
Web / Mobile
Agents & Customers
HTTPS / TLS 1.3
Edge / CDN
Azure Front Door
Global CDN + WAF + DDoS Protection
Routed to primary region (failover to secondary)
App Tier
App Services
Auto-scaling
API Gateway
Rate limiting
Service Bus
Async messaging
Internal VNet - Private endpoints only
Data Tier
Azure SQL
Geo-replication
Redis Cache
Session / hot data
Blob Storage
AES-256 encrypted
Key retrieval via private endpoint
Security
Azure Key Vault
Secrets & BYOK
Azure AD / Entra
Identity & SSO
Audit Log Store
Immutable, 7yr
Regions
Primary
East US
Active
Failover
West US
Hot standby
GDPR
EU West
Frankfurt
CDN / Edge
Application
Data
Security & Identity
Region
99.9%
Uptime SLA
Enterprise plan. Active-active regional failover. Measured monthly, excluding scheduled maintenance.
3
Azure Regions
East US primary, West US failover, EU West for GDPR data residency. Additional regions on qualifying plans.
<60s
Failover RTO
Azure Front Door routes traffic to standby region automatically. No manual intervention required.

Encryption

Encrypted Everywhere. At Every Layer.

Every byte of your data is protected in transit and at rest. We use industry-standard encryption algorithms and allow enterprise customers to manage their own keys.

Encryption in Transit

All connections to and within Velaro are encrypted. No exceptions.

  • TLS 1.2 minimum enforced across all endpoints
  • TLS 1.3 preferred - negotiated automatically for supporting clients
  • HSTS enforced - browsers cache HTTPS-only policy
  • Azure Front Door WAF terminates TLS at the edge
  • Internal service-to-service traffic encrypted via private VNet
  • TLS 1.0 and 1.1 are disabled on all surfaces

Encryption at Rest

All stored data is encrypted. Chat transcripts are tenant-isolated and encrypted at the row level.

  • AES-256 for all data at rest across Azure SQL, Blob, and Redis
  • Azure-managed keys by default - fully managed key rotation
  • BYOK (Bring Your Own Key) available on Enterprise plans via Azure Key Vault
  • Chat transcripts encrypted at rest, tenant-isolated, never co-mingled
  • Passwords are never stored - bcrypt-hashed tokens only
  • Backup encryption matches primary storage standards

Access Controls

Least-Privilege Access. Full Audit Trail.

Enterprise identity integration, fine-grained roles, MFA enforcement, and complete audit logging of every administrative action.

Identity & Authentication

Connect your identity provider. Enforce your policies.

  • SSO via SAML 2.0 - Okta, Azure AD, Google Workspace, Ping, and others
  • OIDC support for modern identity providers
  • SCIM provisioning for automated user lifecycle management
  • MFA enforced for all admin accounts - cannot be disabled
  • MFA enforced for all users on Enterprise plans (configurable)
  • IP allowlisting available as Enterprise add-on
  • Session timeout policies configurable per role

Roles & Audit Logging

Granular roles with a complete, tamper-evident log of every action.

  • Admin - full system configuration access
  • Supervisor - team management, reporting, queue oversight
  • Agent - conversation handling only
  • Analyst - read-only reporting and analytics
  • Read-Only - view without modification rights
  • Every admin action logged: user, timestamp, IP address, change detail
  • Audit logs are immutable and retained per your data retention policy

Compliance Posture

Where We Stand on Every Framework Procurement Asks About

Held, inherited, or in progress - each one labelled for what it actually is. Documentation and BAAs are available to qualifying customers.

SOC 2 Type II
Evidence Gathering

Readiness assessment in progress alongside our platform migration. We operate to SOC 2 Trust Service Criteria today and complete your SIG questionnaire directly.

HIPAA Ready
Enterprise Plus

Business Associate Agreement included on Enterprise Plus contracts. Enhanced audit logging, extended retention, and HIPAA-specific controls configuration.

PCI Scope Reduction
SAQ-A in progress

Velaro's Secure Form module routes card capture through PCI-DSS Level 1 validated processors (Stripe Elements and other certified injectors). Cardholder data is tokenized at the processor and never enters Velaro's platform. SAQ-A self-assessment in progress.

GDPR
Compliant

EU data residency in Azure EU West (Frankfurt). Data Processing Agreements available. GDPR Article 17 deletion requests honored within 30 days.

CCPA
Compliant

California Consumer Privacy Act compliance. Consumer data requests honored. Data subject rights (access, deletion, portability) supported natively.

Azure Security Baseline
Implemented

Full Microsoft Azure Security Benchmark implementation. Continuous compliance posture monitoring via Microsoft Defender for Cloud.

PII Redaction / DLP
Implemented

Automatic detection and masking of SSN, SIN, credit card, CVV, and bank account numbers across live chat, email, SMS, tickets, and social — with custom patterns, per-channel control, and an audit log. See PII redaction & DLP details →

Data Handling

Your Data is Yours. Always.

We never sell, share, or monetize your data. Every customer's data is fully isolated and exportable at any time.

Topic Our Policy
Tenant Isolation Each customer's data is completely isolated at the database and storage layer. No data co-mingling. Tenant ID is enforced at every API endpoint.
Data Retention Configurable from 30 days to 7 years. Default is 12 months. Enterprise customers can set custom retention policies per data category (transcripts, recordings, contact records).
Right to Deletion GDPR Article 17 compliant. Submit a data purge request via your account portal or to privacy@velaro.com. Full purge completed within 30 days of verified request.
Data Exports Full data export available at any time through the admin console. Includes all transcripts, contact records, and configuration. Exports delivered as structured JSON or CSV within 24 hours of request.
Data on Cancellation You have 30 days post-cancellation to export your data. After the export window closes, all data is permanently purged from production systems, backups, and disaster recovery stores.
Do We Sell Your Data? No. We do not sell, license, or share your data with third parties for advertising or any commercial purpose. Full stop.

Sub-Processors

The following third-party services process data on our behalf as data processors. None are data controllers of your customer data.

Microsoft Azure

Cloud infrastructure

Twilio

SMS / voice channels

SendGrid

Transactional email

ElevenLabs

Voice synthesis (IVR)

OpenAI

AI features (opt-in)

Vulnerability Management

Proactive Security. Rapid Response.

We operate a responsible disclosure program, scan dependencies continuously, and patch critical vulnerabilities within 72 hours.

🔐

Responsible Disclosure

Found a vulnerability? We want to know. Email security@velaro.com with details. We acknowledge all reports within 24 hours and commit to transparent communication throughout remediation. We do not pursue legal action against good-faith researchers.

⚡

Patch SLA

Critical CVEs (CVSS 9.0+) are patched and deployed within 72 hours of confirmed impact assessment. High severity (7.0–8.9) within 7 days. Medium and below are addressed in our regular release cycle. Security patches are never delayed for feature releases.

🔍

Dependency Scanning

All third-party dependencies are scanned on every CI/CD pipeline run using automated SAST and SCA tooling. Builds with known critical vulnerabilities in dependencies are blocked from deployment. Annual penetration testing is conducted by an independent third-party firm.

Security FAQ

Questions We Hear from InfoSec Teams

Answers to the questions that come up in every enterprise security review.

No. Velaro does not sell, license, share, or monetize customer data in any form. Your data - including all conversations, contact records, and usage data - is used exclusively to provide you the Velaro service. We do not use it to train AI models without explicit opt-in, and we do not provide it to third parties for advertising or analytics purposes.
By default, data is stored in the United States on Azure East US (primary) with replication to Azure West US. For GDPR compliance or data sovereignty requirements, EU data residency is available on qualifying plans - data is stored in Azure EU West (Frankfurt, Germany). Additional regions are available for enterprise customers with specific residency requirements. Contact your account manager to configure data residency before your account goes live.
Yes. Velaro provides a Business Associate Agreement (BAA) as part of our HIPAA compliance package, included with Enterprise Plus contracts. The package covers the BAA, enhanced audit logging, extended data retention, dedicated compliance review, and HIPAA-specific controls configuration. BAAs require an executed Enterprise Plus agreement — they are not available on self-service or standard plans. Contact sales@velaro.com to discuss Enterprise Plus terms.
Yes, and we do more than hand you a document. Our security team completes your Security Information Gathering (SIG) questionnaire, CAIQ, or in-house vendor assessment directly, line by line, so you get current answers about our actual controls rather than a static report written for a different buyer. You also get our annual third-party penetration test summary findings, architecture documentation, and a live security Q&A session with the engineers who built the system. Our own SOC 2 Type II readiness assessment is underway and we will say plainly where each control stands. Email security@velaro.com with your organization name and use case to begin.
Upon cancellation, you have a 30-day window to export all your data through the admin console. Exports include full conversation transcripts, contact records, team configuration, and analytics data in structured format. After the 30-day window, all data - including backups and disaster recovery copies - is permanently purged. You will receive a written deletion confirmation upon request.
Yes. Velaro undergoes annual penetration testing conducted by an independent third-party security firm. The scope covers our production web application, API endpoints, authentication flows, and infrastructure configuration. Summary findings and remediation evidence are available to enterprise customers under NDA as part of the security review package. We also conduct internal red team exercises on a quarterly basis.

Get the documentation your InfoSec team needs.

Send us your questionnaire and we fill it in: SIG or CAIQ answered directly, security Q&A with our engineers, pen test summary, and dedicated InfoSec support.

Request Security Documentation security@velaro.com