Security & data handling
Written for the person accountable for the brokerage's files. Updated August 2026 — this page changes when the infrastructure does.
Tenant isolation
Each brokerage runs as its own tenant on its own subdomain. Every API request resolves the organization from the hostname and the caller's verified membership; all records are organization-scoped, and documents are stored under per-organization prefixes. There is no cross-tenant query path.
Encryption
All traffic is TLS. Documents and transaction data are stored on Cloudflare's infrastructure (R2 object storage and D1), which encrypts data at rest.
Your data does not train AI models
Documents are processed for inference only — extraction, findings, and answers for your own workspace. We do not train models on customer data. AI inference runs on Microsoft Azure OpenAI Service, whose terms likewise exclude customer data from model training.
Subprocessors
Cloudflare (hosting, storage, database), Microsoft Azure OpenAI Service (AI inference), Google Cloud (video rendering), Google Firebase (authentication), and Resend (transactional email). No file content is shared with any other third party.
Access controls and audit logging
Access is invitation-only with role-scoped permissions per member. Document access and consequential actions are recorded to an audit trail. AI findings are advisory and carry the source page and verbatim quote they came from; nothing auto-approves, and an approval is invalidated when the document under it changes.
Verifiable exports
Any transaction exports to an archive with a per-file SHA-256 manifest and a recomputable root hash — integrity is checkable with standard tooling, without trusting us.
Retention and deletion
Retention rules are configurable per record class in the workspace. On pilot termination we delete your tenant data on request and confirm it in writing.
Incidents
Security incidents affecting your data are disclosed to your named pilot contact promptly, with what happened, what was affected, and what we changed.
Certifications (roadmap)
Vetta Broker is not yet SOC 2 certified; certification is on the roadmap as pilots scale. A mutual NDA and a data-processing agreement are available before any file moves — ask at [email protected].
Related: pilot terms · privacy policy