Encryption in transit
HTTPS on every public endpoint, terminated at the Cloudflare edge. TLS 1.2 and 1.3 are accepted; older versions are refused. HSTS with preload is set on vedika.io.
Trust & Procurement
What we run, who processes data for us, where it lives, and the certifications we hold today. Updated whenever our controls or sub-processors change.
Last updated: 21 October 2026
Multi-region Cloud infrastructure requests routed automatically
In progress SOC 2 Type II no report held yet
30 days Sub-processor notice changes posted on this page
Stored Chats and birth details retention: see Privacy Policy
Certifications & Status
Each line is the honest current status. We will not claim a badge we do not hold today. Update cadence: quarterly or sooner if a control changes.
Security Controls
These are the controls Vedika operates in production. Each is also documented in the procurement questionnaire at the bottom of this page, with the control owner and the evidence we can share.
HTTPS on every public endpoint, terminated at the Cloudflare edge. TLS 1.2 and 1.3 are accepted; older versions are refused. HSTS with preload is set on vedika.io.
S3 server-side encryption (AES-256), encrypted Aurora PostgreSQL storage and KMS-encrypted DynamoDB tables.
API keys hashed with SHA-256 server-side; plaintext never written to logs, never returned in error bodies. Service credentials are held in AWS Secrets Manager and injected into containers at start.
Public traffic reaches the API only through Cloudflare and an AWS load balancer; the load balancer accepts traffic only from Cloudflare. API task security groups have no inbound rule open to the internet, only to the VPC.
Access to AWS is through IAM. The AWS root account is protected by MFA. AWS CloudTrail records AWS API activity in an organisation-wide, multi-region trail.
Application and request logs go to CloudWatch. Retention is 180 days for the API service, and shorter for some auxiliary services.
Dependency advisory scanning (npm audit and language-native advisory checks) and enhanced image scanning on every push to the container registry. Critical vulnerabilities are handled ahead of other work, and a vendor patch is applied as soon as it is available.
We review the public API and dashboard for vulnerabilities and track findings to a fix. For the status of independent penetration testing, ask [email protected]; we will say plainly what has and has not been done.
Cloudflare proxies all public traffic. AWS WAF (common-rule, known-bad-input and IP-reputation groups, plus rate-based rules) protects the load balancer and the CloudFront distribution. AWS Shield Standard is on. API keys are rate limited.
Aurora automated backups with 35-day retention. AWS Backup takes daily copies (kept 35 days) and weekly copies (kept 120 days) and replicates them to a second region. Point-in-time recovery is on for the conversations table.
You can ask us to delete your account and data; the Privacy Policy describes how. Chats are retained as that policy states, including for future model training. For customers on a signed enterprise agreement, Customer Content is used to train or improve our models only if the customer opts in, as the Master Service Agreement says (clause 7.2). Backup copies are not edited and leave on the schedule above, up to 120 days for weekly copies.
Every production or security incident is written up in a dated record with timeline, impact, root cause and closure checks. CloudWatch alarms alert the team in Slack and by email. We notify affected customers without undue delay after a confirmed incident affecting their data.
Sub-processors
A sub-processor is a third party that processes customer data on our behalf. This table lists each one that processes data in production today and what it receives. A provider we hold credentials for but whose code path is not live is not listed. Processing locations are agreed with enterprise customers at signup (see Data residency below); ask [email protected] for those that apply to your account. Changes are posted on this page at least 30 days before they take effect. To object to a change, email [email protected] within 30 days of notice.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Hosting and delivery | |||
| Amazon Web Servicesaws.amazon.com | Production hosting: ECS compute, Aurora PostgreSQL, DynamoDB, ElastiCache, S3, Lambda (report rendering), CloudFront, CloudWatch, Secrets Manager and AWS Backup. Also hosts our self-hosted CRM. | Everything we store: account records, hashed API keys, usage and billing records, chats (questions, answers and birth details you supply), generated reports, uploaded floor plans, palm readings (kept for 30 days and deletable at any time through the Palm API, with a one-way digest of the photo so the same photo returns the same reading), application logs, and CRM contact and enquiry records. | Multi-region cloud infrastructure, routed automatically ISO 27001, 27017, 27018 · SOC 1/2/3 · PCI-DSS L1 |
| Cloudflarecloudflare.com | DNS, TLS termination, CDN, DDoS protection and proxy in front of vedika.io, api.vedika.io and our CRM. Bot challenge (Turnstile) on login. Web analytics only with your consent. | All traffic to those hostnames in transit, including API requests and responses (which can contain birth details and prompts), API keys in request headers, IP addresses and browser details. | Global edge network SOC 2 Type II · ISO 27001 · PCI-DSS L1 |
| AI processing (receives the request content, which may include birth details) | |||
| AI compute and model providers | Vedika runs inference on raw compute and through enterprise agreements with all major model providers, routed automatically per request. | The request content needed to produce the answer. | Multi-region, routed automatically |
| Payments, email and support | |||
| Razorpayrazorpay.com | Payment processing for wallet top-ups and subscriptions. Card data never reaches Vedika servers. | Payment details you enter at checkout (card or UPI, held by Razorpay), name, email, transaction and subscription references, refund processing. | Provider-managed cloud PCI-DSS Level 1 service provider |
| Resendresend.com | Sending email: sign-up confirmation, security alerts, receipts, support replies and product notices. Receives inbound email for support. | Recipient email address, name, message content and delivery metadata. | Provider-managed cloud SOC 2 Type II |
| Hostingerhostinger.com | Hosts our business mailboxes (support@, security@ and staff addresses); mail to vedika.io is delivered there. | Every email you send to a vedika.io address, with attachments. | Provider-managed; data-centre location depends on the hosting plan |
| Atlassianatlassian.com | Support tickets and service-desk tracking (Jira Service Management). | Your name and email, ticket subject and message, the support-chat transcript, and attachments you send. | Provider-managed cloud; Atlassian chooses the hosting region |
| Slackslack.com | Internal hand-off notification when a support chat asks for a person. | Requester name, email, company and plan, and the first 140 characters of the issue. | Provider-managed cloud |
| Website analytics and advertising (vedika.io visitors; consent rules below) | |||
| Googlegoogle.com | Google Analytics 4 and the Google Ads tag on vedika.io; server-side conversion uploads for sign-ups and purchases (Data Manager API); text-to-speech for the Voice API. | Page and sign-up events, cookie and device identifiers, ad-click identifiers, and a SHA-256 hash of your email address for conversion matching, sent only where a consent record exists. Text to be spoken, for the Voice API. | Global network |
| Microsoftclarity.microsoft.com | Microsoft Clarity session replay on vedika.io. Loads only after you actively accept analytics. | Page interactions and device details of visitors who accept. | Global network |
| Metameta.com | Meta pixel on vedika.io. Loads only after you actively accept marketing cookies. | Page events and device identifiers of visitors who accept. | Global network |
AI processing. Request content includes any images you upload (for example floor plans) and audio you send to the Voice API. Vedika keeps no copy of palm photographs you send to the Palm API. To make the reading, each photograph is sent over an encrypted connection to the AI model providers that Vedika uses as sub-processors (see the AI processing row above), who may hold inputs for a limited period under their own terms. Vedika does not use palm photographs to train or improve any model. Prompts can contain birth details you supply, so treat them as personal data.
Analytics consent. In the EEA, the UK and other opt-in regions, analytics and marketing tags stay off until you accept. In India and other opt-out regions Google Analytics and the Google Ads tag run unless you opt out or your browser sends a Global Privacy Control signal. Clarity and Meta always need an explicit choice. Details are in the Privacy Policy.
Not sub-processors. GitHub holds our source code and receives no customer data. Our staff-only HR workspace in Atlassian holds employee and candidate records, not customer data. Notice period for sub-processor changes: 30 days, posted on this page and sent by email to the account owner or shown in the dashboard. We do not introduce new sub-processors that handle personal data without prior notice.
Data residency
Vedika runs on multi-region cloud infrastructure and routes each request automatically. Customers agree any data-residency needs at signup, as part of enterprise terms. Regional processing and backup requirements are reviewed by contract, as described on the Security page.
Default · Multi-region
Contractual · Residency
Customers agree any data-residency needs at signup, as part of enterprise terms. If your regulator requires processing in a specific country or region, for query text and not just stored records, that is a contract and engineering discussion, not a setting you can switch on. Contact [email protected] before you build.
Cross-border transfers rely on intra-group data-transfer agreements, written sub-processor contracts, EU Standard Contractual Clauses or the UK International Data Transfer Addendum where required, and the cross-border rules of the DPDP Act where applicable.
Vulnerability Disclosure
We run a coordinated disclosure program. Researchers and customers can report findings to [email protected]; PGP key on request. We will not pursue lawful disclosure activity.
Email [email protected] with a description, impact, and a reproducible proof-of-concept. PGP key on request. We acknowledge reports promptly and take critical reports first.
We confirm scope, severity, and impact. You will hear from the security team (Sam) or the founder (Abhishek) promptly. We will not pursue lawful disclosure activity and we will not ask researchers to sign a non-disclosure before sharing a fix.
Critical vulnerabilities are fixed ahead of other work, and vendor patches are applied as soon as they are available. After deployment, we publish a short incident note on /status with the fix window and the customer-impact summary. Credit goes to the reporter if they want it.
Procurement Questionnaire
We send a completed CAIQ-lite security questionnaire on request. Each answer names the system or document behind it, so you can satisfy a vendor risk review without a back-and-forth. A self-service download is not published yet.
Controls map to SOC 2 Trust Services Criteria, ISO 27001 Annex A and the Cloud Security Alliance CAIQ v4. Each answer includes the control owner and the evidence we can share.
Request
GDPR-aligned, EU SCCs ready, DPDP Act ready. Available on request to [email protected] for Business and Enterprise plans. We return a countersigned copy promptly after your request.
Request
A summary of our security testing and its status, available under NDA. Email [email protected].
Notice
Add, replace or remove a sub-processor: 30 days' notice on this page, by email to the account owner or in the dashboard.
FAQ
No. Vedika holds no SOC 2 report today. Please do not describe Vedika as SOC 2 attested. The Trust Centre lists the controls we operate today.
Vedika runs on multi-region cloud infrastructure and routes each request automatically. Customers agree any data-residency needs at signup, as part of enterprise terms. Account records, chats, generated reports, usage history and billing are stored in our AWS account, and backup copies are replicated to a second region. AI inference runs on raw compute and through enterprise agreements with all major model providers, routed automatically per request; they receive the request content needed to produce the answer, which may include birth details you supply. Cloudflare proxies all traffic to vedika.io and api.vedika.io. If you need processing in a specific country or region, contact [email protected] before you build.
Yes. We store chats, including questions, answers and birth details supplied in the conversation, in our AWS account, and we keep them, including for future model training. For customers on a signed enterprise agreement, Customer Content is used to train or improve our models only if the customer opts in, as the Master Service Agreement says (clause 7.2). Active conversations expire after 24 hours by default (seven days for enterprise API keys); expiry ends active access and is not deletion. Operational logs are kept in CloudWatch for 180 days. The Privacy Policy is the authority on retention.
Yes. DPAs are available on request to [email protected] for Business and Enterprise plans. We sign standard DPAs including GDPR-aligned processing terms and the cross-border transfer mechanisms the DPDP Act, GDPR and UK GDPR require.
Sub-processor changes are posted on this page at least 30 days before they take effect. Notice also goes by email to the account owner, or in the dashboard, for any change that handles personal data. Customers may object to a change within 30 days of notice.
DPA, sub-processor change notice, custom questionnaire, or a specific certification evidence pack. The procurement team replies promptly.