Trust
How Veqen protects your data, who helps run it, and where to find the documents your security and legal teams ask for.
What we never see
Prompts, responses, documents and embeddings. The SDKs send the usage block of each response, the model and your tags, and the API has no field for content.
Keys and credentials
API keys are stored only as hashes and can expire, be limited to your addresses and rotate with a grace period. Provider and Stripe keys are encrypted by the application and only ever used to read.
Access
Roles for every member, an audit log of changes, SAML or OIDC single sign-on and SCIM provisioning on Enterprise. Our staff can view your dashboard only with an owner's approval, read-only, for a limited time, and every view is logged.
Infrastructure
Microsoft Azure in the United States. TLS everywhere, encryption at rest, 14-day backups, a strict Content Security Policy and HSTS on every page.
Availability Status page →
The service is operational right now. Uptime is measured every minute and published, with every incident, on the status page. Enterprise plans include a 99.9% uptime SLA with service credits.
Sub-processors
| Company | Where | What for |
|---|---|---|
| Microsoft Azure | United States | Hosting, database, logs, and Azure OpenAI for the optional AI analyst and draft assistant |
| WorkOS | United States | Sign-in, single sign-on and directory sync |
| Stripe | United States | Payments and invoices |
| Resend | United States | Service and alert email |
Cost sources and alert destinations you connect (OpenAI, Anthropic, your cloud accounts, Stripe, Slack, webhooks) are your own accounts, not sub-processors. New sub-processors are announced here 30 days ahead.
Documents
- Data Processing Addendum to sign: print or save it as a PDF, or ask us to countersign
- Service Level Agreement Enterprise
- Security and privacy what's stored, how, and for how long
- Privacy policy · Terms of service · Acceptable use
Security questionnaires and reports of a vulnerability: support@veqen-app.com.