Security and data

• Data stored in London, in the UK.
• Encrypted in transit (TLS 1.2 or 1.3) and at rest (AES-256). Tax references are encrypted a second time by Vedas itself.
• AI models never keep your data and never train on it.
• Each firm's data kept apart by the database, checked on every request.
• No passwords to steal: sign-in links that work once.
• Client documents deleted on a schedule your firm chooses.
• A written process if anything goes wrong, with notice to your firm within 48 hours.

Documents and the database are stored in London. The app runs in the Netherlands, in the EU. The Subprocessors page lists every company that processes data for Vedas, and where.

Vedas uses AI models to read documents and draft work. Code computes every figure. Your firm's accountant reviews the work and signs it off, and Vedas files nothing and sends nothing for you. Read more in AI use.

Every request to an AI model is sent with zero data retention, and training on the data is refused. A check in our code refuses any request that does not meet both rules, before it leaves our servers.

The models that read documents run in the EU, with no fallback elsewhere.

The database keeps each firm's data apart and checks this on every request. Only people in your firm can see its jobs. Our staff have no screen that opens your firm's jobs. Each job's requests to the AI models use their own key with their own spend limit.

• In transit: every connection uses HTTPS with TLS 1.2 or 1.3, the same encryption banks use online. Unencrypted connections are redirected to HTTPS.
• At rest: the database, files and backups are encrypted with AES-256 by our database and file host, which is independently audited to SOC 2 Type 2.
• A second layer: tax references (such as UTRs and VAT numbers) and stored keys are encrypted again by Vedas with AES-256-GCM before they are saved, so a copy of the database alone does not reveal them.

There are no passwords to steal: you sign in with a link we email, which works once, for an hour. Downloads use links that expire after 5 minutes.

Client documents are deleted after your firm's retention period: 7, 30 or 90 days after a job closes, as your firm chooses. A job that finished but was never unlocked has its documents deleted 30 days after it finished. The outputs, such as the pack, are kept for your records.

If no one at your firm signs in or uses Vedas for 60 days, we delete your firm's documents and outputs. After 6 months with no use, we close the account and delete all its data. We email your firm's Partners at least 14 days before either step.

We follow a written process if data is ever exposed, including through an attack on our systems or a provider's systems. We tell your firm within 48 hours, so it can protect its clients and delete any data it holds in Vedas if it chooses. We report attacks to the UK's cyber security authorities, contain the breach and fix the cause. Our Data Processing Agreement sets out the full steps.

If you think you've found a security problem, or that data has been exposed, email hello@vedas.cloud. Please don't include client documents or figures. We'll reply as soon as we can.