Security & Data Handling

Vectrex Compliance is an AI compliance suite for UK regulated firms. The client firm is the data controller for all case files uploaded to the platform; Vectrex Compliance Ltd acts as data processor under UK GDPR.

Client case files are streamed from private storage into memory, assessed against the applicable checklist, and permanently purged from our storage the moment the assessment record is written to the database. We retain the machine-readable audit trail — never the original document bytes.

The platform runs on our hosting provider's Business plan, which gives us private-by-default published environments, role-based workspace access with single sign-on for our own staff, managed encrypted Postgres with point-in-time recovery, and a hosted Trust Centre that publishes our current control set in both human-readable and machine-readable form.

Every file uploaded to the APEX agent flows through a strictly-scoped pipeline built around four non-negotiable guarantees:

• Provider: a single OpenAI-compatible edge AI gateway operated by our hosting provider, which fronts the underlying model vendors on enterprise zero-data-retention terms.
• Model providers: Google Gemini and OpenAI models are used through the gateway. Current workloads include Gemini models for assessment, extraction and selected fallbacks; OpenAI models for selected reasoning, remediation, embeddings and narration tasks. Model selection may change as services are improved, but every model remains subject to the same gateway, data-minimisation and governance controls described here.
• Commercial terms: no training on inputs and no long-term retention of prompt or response bodies. Operational telemetry is limited to log identifiers used for billing and abuse prevention — not payloads.
• Our reinforcement: the zero-data-retention system-prompt clause described in section 2(c) is present on every AI call, belt-and-braces with the contractual terms.
• Egress: exactly one outbound destination for AI. No secondary providers, no per-tenant bring-your-own-key, and no direct calls to model vendors.
• Spend and abuse controls: gateway usage is metered per request, with workspace-level usage limits and per-module cost monitoring so runaway or anomalous usage is visible.

• Client authentication uses our managed auth provider (email and password, or Google sign-in) with short-lived JWT sessions and refresh-token rotation.
• Leaked-password protection and password-strength requirements are applied at the auth layer.
• Access tokens are attached to server calls by a client middleware; there is no bespoke token handling in application code beyond the standard client SDK.
• Roles are stored in a dedicated user_roles table (never on the user profile) and checked through a SECURITY DEFINER function to prevent recursive-RLS privilege escalation.
• Module entitlement is allow-list based: a user sees a module only where the firm is entitled and the user has been explicitly granted access. Entitlement is re-validated server-side on every privileged call, not just in the interface.
• Row-Level Security is enabled on every application table; policies scope reads and writes to the caller's organisation membership.
• Internal access: our own staff reach the platform through workspace accounts on our hosting provider's Business plan, which supports single sign-on and role-based workspace permissions. Non-production environments are private by default and require workspace membership to open.

• All secrets live in the managed secret store and are injected at runtime as environment variables. They are never committed to source control.
• The service-role database key is loaded only inside server-only modules and is never imported at the module scope of files that ship to the browser bundle.
• Only publishable, safe-by-design keys ever reach the client.
• Keys can be rotated at any time; rotation invalidates prior credentials immediately.

• TLS 1.2+ is enforced on all ingress: vectrexcompliance.com, notify.vectrexcompliance.com and the platform preview and production hosts. Certificates are managed and renewed automatically.
• Storage buckets are encrypted at rest by the underlying platform.
• Postgres data-at-rest encryption is inherited from the managed database service.
• Signed URLs used for uploads and downloads are short-lived and scoped to a single object.

• The managed Postgres service takes automated daily backups, with point-in-time recovery available on our current plan so the database can be restored to a chosen moment rather than only to the last nightly snapshot.
• Backups inherit the encryption and access controls of the managed database service; restores are performed by authorised administrators only.
• Because original client documents are purged post-commit, they are not present in database backups. Backups contain the assessment audit trail, not client document bytes.
• Application code, migrations and configuration are held in version control, so an environment can be rebuilt from source and re-pointed at a restored database.
• We do not publish a contractual RTO or RPO. Where a firm requires committed recovery targets, they are agreed in the signed contract rather than asserted here.

• Server-function, database and edge-runtime logs are retained by the hosting platform and are available to authorised administrators for diagnosis and incident review.
• Log hygiene: filenames and personal data are stripped from APEX log lines; only structural events (for example “[apex] extraction failed for file N of M”) remain.
• In-application audit trails record sign-off, approval, remediation and administrative actions against the acting user, with timestamps, and are exportable for the firm's own records.
• Automated database security linting and dependency scanning run against the project, and findings are triaged rather than left open.
• A nightly integrity scan checks tenant ownership and data-consistency invariants across modules and raises incidents for review.
• Email delivery is monitored for bounces and complaints so failed notifications are visible rather than silent.

• Public API endpoints (/api/public/*) either verify request signatures or expose read-only, non-personal data.
• Server functions default to authenticated middleware; privileged functions additionally verify an administrative role before touching service-role clients.
• Database functions have a pinned search_path; permissive policies identified by security review have been tightened.
• User-supplied HTML is sanitised before rendering, and uploads are constrained by type and size.
• Agent system prompts and internal configuration are not readable by ordinary users.

We will notify contracted clients of any material change to this list. Onward transfers outside the UK are covered by the relevant standard contractual clauses or equivalent safeguards operated by each provider.

• Original uploads: not retained — purged automatically as described in section 2(d).
• Complete extracted document text: not retained. Limited evidence excerpts and AI assessment output needed to explain findings and preserve the audit trail are retained with the assessment record.
• Assessment and audit records: retained for the life of the firm's subscription plus any statutory retention period the firm elects.
• Operational logs: retained for the period offered by the hosting platform and used only for diagnosis, security and abuse prevention.
• Right to erasure: handled by cascading deletion on the organisation record; a firm may request export of its audit trail before deletion.
• Incidents: we investigate reports promptly, notify affected contracted clients without undue delay where a personal-data breach is confirmed, and record the outcome. Report concerns to hello@vectrexcompliance.com.

• This statement, in web and PDF form.
• Our Trust Centre, published at /.well-known/trust.html, with a machine-readable companion at /.well-known/trust.json.
• Privacy policy, cookie policy and platform terms.
• A completed security questionnaire and a Data Processing Agreement, provided on request under NDA where required.
• Sub-processor list and details of our data-minimisation design for a specific module.

• Not an ISO 27001, SOC 2 or equivalent independent attestation. We do not hold those certifications and do not claim them.
• Not a penetration-test report or an assertion of formal regulatory certification.
• Not legal advice.
• It describes the state of the platform at the date of publication and is superseded by any signed Data Processing Agreement between Vectrex Compliance Ltd and the client firm.