Velaro is engineered from the ground up for organizations where security is non-negotiable. Azure-hosted, SOC 2 Type II audit active, AES-256 at rest, TLS 1.3 in transit, and a controls environment your InfoSec team can actually review.
Compliance
We've completed controls mapping and evidence collection. Our Type II audit period is active. The report is available to enterprise customers and qualified prospects under NDA upon request.
We've completed the controls mapping and evidence collection phase. Type I controls have been validated. Our Type II observation period is currently active and ongoing.
The full SOC 2 Type II report will be available to enterprise customers and qualified prospects. We share it under NDA - submit a request and our security team will respond within one business day.
To request the report or a security Q&A session, email security@velaro.com with your organization name and use case.
Azure migration strengthened our control environment. Our 2025 migration to Microsoft Azure significantly enhanced our SOC 2 posture - including native network segmentation, Azure Key Vault for secrets management, centralized audit log completeness, and geo-redundant storage controls that exceed standard SOC 2 requirements.
System protected against unauthorized access, both physical and logical. Covers firewalls, WAF, MFA enforcement, and RBAC controls.
System available for operation as committed. Covers SLA monitoring, incident response, and active-active regional failover architecture.
Information designated as confidential is protected. Covers tenant isolation, data classification, encryption at rest and in transit.
System processing is complete, valid, accurate, and timely. Covers input validation, audit trails, and error handling controls.
Infrastructure
Velaro runs entirely on Microsoft Azure, leveraging the same infrastructure trusted by 95% of Fortune 500 companies. Our architecture is designed for zero single points of failure.
Encryption
Every byte of your data is protected in transit and at rest. We use industry-standard encryption algorithms and allow enterprise customers to manage their own keys.
All connections to and within Velaro are encrypted. No exceptions.
All stored data is encrypted. Chat transcripts are tenant-isolated and encrypted at the row level.
Access Controls
Enterprise identity integration, fine-grained roles, MFA enforcement, and complete audit logging of every administrative action.
Connect your identity provider. Enforce your policies.
Granular roles with a complete, tamper-evident log of every action.
Certifications & Compliance
We support the compliance frameworks that matter to regulated industries. Documentation and BAAs are available to qualifying customers.
Type I controls validated. Type II audit period active. Report available under NDA to enterprise customers and prospects.
Business Associate Agreement included on Enterprise Plus contracts. Enhanced audit logging, extended retention, and HIPAA-specific controls configuration.
Velaro's Secure Form module routes card capture through PCI-DSS Level 1 validated processors (Stripe Elements and other certified injectors). Cardholder data is tokenized at the processor and never enters Velaro's platform. SAQ-A self-assessment in progress.
EU data residency in Azure EU West (Frankfurt). Data Processing Agreements available. GDPR Article 17 deletion requests honored within 30 days.
California Consumer Privacy Act compliance. Consumer data requests honored. Data subject rights (access, deletion, portability) supported natively.
Full Microsoft Azure Security Benchmark implementation. Continuous compliance posture monitoring via Microsoft Defender for Cloud.
Data Handling
We never sell, share, or monetize your data. Every customer's data is fully isolated and exportable at any time.
| Topic | Our Policy |
|---|---|
| Tenant Isolation | Each customer's data is completely isolated at the database and storage layer. No data co-mingling. Tenant ID is enforced at every API endpoint. |
| Data Retention | Configurable from 30 days to 7 years. Default is 12 months. Enterprise customers can set custom retention policies per data category (transcripts, recordings, contact records). |
| Right to Deletion | GDPR Article 17 compliant. Submit a data purge request via your account portal or to privacy@velaro.com. Full purge completed within 30 days of verified request. |
| Data Exports | Full data export available at any time through the admin console. Includes all transcripts, contact records, and configuration. Exports delivered as structured JSON or CSV within 24 hours of request. |
| Data on Cancellation | You have 30 days post-cancellation to export your data. After the export window closes, all data is permanently purged from production systems, backups, and disaster recovery stores. |
| Do We Sell Your Data? | No. We do not sell, license, or share your data with third parties for advertising or any commercial purpose. Full stop. |
The following third-party services process data on our behalf as data processors. None are data controllers of your customer data.
Cloud infrastructure
SMS / voice channels
Transactional email
Voice synthesis (IVR)
AI features (opt-in)
Vulnerability Management
We operate a responsible disclosure program, scan dependencies continuously, and patch critical vulnerabilities within 72 hours.
Found a vulnerability? We want to know. Email security@velaro.com with details. We acknowledge all reports within 24 hours and commit to transparent communication throughout remediation. We do not pursue legal action against good-faith researchers.
Critical CVEs (CVSS 9.0+) are patched and deployed within 72 hours of confirmed impact assessment. High severity (7.0–8.9) within 7 days. Medium and below are addressed in our regular release cycle. Security patches are never delayed for feature releases.
All third-party dependencies are scanned on every CI/CD pipeline run using automated SAST and SCA tooling. Builds with known critical vulnerabilities in dependencies are blocked from deployment. Annual penetration testing is conducted by an independent third-party firm.
Security FAQ
Answers to the questions that come up in every enterprise security review.
Enterprise buyers get the full package: SOC 2 report, security Q&A, pen test summary, and dedicated InfoSec support.