Security & Compliance
How we handle your data and your users' data: storage, chat retention, access controls and security requests.
Built on managed cloud infrastructure with security controls at every layer.
Hosted on managed, auto-scaling infrastructure with tenant-isolation controls.
HTTPS with TLS for all data in transit. Data encrypted at rest using cloud-managed encryption keys. No unencrypted connections accepted.
All API keys are hashed with SHA-256 before storage. Plaintext keys are never stored in our systems. Rate limiting per key prevents abuse.
Standard plans use shared infrastructure with account-level access controls. A dedicated stack is available case by case through a signed order form. Capacity, isolation, provisioning and support terms are agreed for that order.
Per-API-key rate limiting protects against abuse and ensures fair resource allocation. Configurable limits available on Enterprise plans.
Infrastructure scales with traffic. Enterprise capacity and recovery requirements are agreed in a signed order form.
We store chats and other account records. Chat expiry and stored-data retention are separate.
We store chats, including questions, answers and birth details supplied in the conversation. Chats are kept, including for future training. Active conversations expire after 24 hours by default, or seven days when created through an enterprise API key. Conversation settings can extend that lifetime. Expiry ends active chat access; it does not mean the stored data is deleted.
We retain operational records for service operation, billing, security and support. Chat expiry does not delete operational records or backups. Contact us to review retention requirements.
Chats are kept, including for future training. Tell your users how their data will be handled before sending it to Vedika.
Users can request deletion of any stored data by contacting [email protected]. We review deletion requests and the retention requirements that apply to the records.
Multi-layered authentication ensures only authorized users access your resources.
All API requests require a valid key (format: vk_live_*). Keys are scoped to individual projects for granular access control.
API keys can be rotated anytime from the developer console. Old keys are invalidated immediately upon rotation. No downtime required.
Failed authentication attempts are rate-limited to prevent brute-force attacks. Repeated failures trigger temporary lockouts.
Administrative features require an authenticated account with an authorized role.
Each API key is scoped to a single project. Compromising one key does not affect other projects or customers.
All authentication events are logged with timestamps, IP addresses, and request metadata for compliance and forensic analysis.
Review the current controls and data-handling terms against your requirements before integrating.
We process data on behalf of our customers under the data processor model. Our customers are the data controllers responsible for obtaining user consent.
Account records are stored in India (Mumbai). Chat context and query text may be processed outside India. Regional processing and backup requirements must be reviewed and recorded in a signed order form.
Contact us to review documented controls for your security assessment.
Current controls available for review
Security and data-handling commitments must be stated in a signed order form.
Signed order form
We take security reports seriously and respond quickly to protect our customers.
Found a security vulnerability? Report it responsibly.
Include a detailed description, steps to reproduce, and potential impact.
Our security team will review your report and confirm receipt.
We prioritize critical vulnerabilities and deploy fixes as fast as possible.
We do not currently operate a bug bounty program. We appreciate responsible disclosure and will credit reporters (with permission) in our security advisories.
Live service status and enterprise terms are available below.
Live service status: vedika.io/status. Uptime and support terms for enterprise plans are agreed in a signed order form.
Dedicated capacity and redundancy requirements are reviewed case by case and recorded in a signed order form.
Discuss recovery requirements before integration. The agreed scope belongs in the signed order form.
Common questions from security and compliance teams.
We store chats, including questions, answers and birth details supplied in the conversation. Chats are kept, including for future training. Active conversations expire after 24 hours by default, or seven days when created through an enterprise API key. Conversation settings can extend that lifetime. Expiry ends active chat access; it does not mean the stored data is deleted.
Yes. We provide Data Processing Agreements for customers who need them for GDPR or other regulatory compliance. Contact [email protected] to request a DPA.
Account records are stored in India (Mumbai). Chat context and query text may be processed outside India. Regional processing and backup requirements must be reviewed and recorded in a signed order form.
Answer generation can use the query text and conversation context outside India.
Contact us before integration to review regional processing requirements. Any agreed arrangement belongs in a signed order form.
Chats are kept, including for future training. This includes the content and birth details supplied in a conversation.
Our team is ready to discuss your security requirements, provide documentation, or schedule a security review.