Trust and security
What we have built, and what we have not
VeoCue is an early product. This page describes the controls that exist today and names the certifications we do not hold, because a security page that only lists good news is not worth reading.
Accurate as of 22 September 2026
How it is built
Where it runs
VeoCue runs in a single AWS account. The application, the database, the crawlers and the queues are all inside it. Your signals and competitor lists are not copied to a third-party data warehouse or an analytics vendor.
AWS · one account · private networking between the app and the database
One database, workspaces kept apart by the database itself
Customer data lives in Aurora PostgreSQL Serverless v2. Every tenant-owned table carries the workspace it belongs to and has FORCE ROW LEVEL SECURITY enabled, so PostgreSQL applies the policy to the table owner as well. A query that forgets to filter by workspace returns nothing rather than someone else's rows.
Aurora PostgreSQL Serverless v2 · FORCE ROW LEVEL SECURITY per tenant table
Customers and staff sign in through different pools
There are two Amazon Cognito user pools: one for customer accounts and a separate one for VeoCue staff who use the admin console. They are different pools with different clients, so a customer account cannot be used to reach staff tooling, and the two sets of credentials are not interchangeable.
Two Cognito user pools · customer and staff separated
Multi-factor authentication is available
Both pools support time-based one-time codes from an authenticator app. It is available rather than compulsory today, and we can turn it on for your workspace if you would prefer it enforced.
TOTP via an authenticator app · available on both pools
Your data
What we keep, and how you remove it
The product's whole argument is that you can check its work, which means the evidence has to be stored. Here is what that amounts to.
What a signal stores
Every signal keeps the URL it came from and the date it was detected, alongside the change itself. That is what makes a brief checkable: you can open the page and see whether we read it correctly.
Deleting a competitor deletes its signals
Removing a tracked competitor from a workspace removes the signals gathered for it. There is no shadow copy kept for analytics.
What we collect about you
The details you give us when you sign up or ask for a demo, and the ordinary operational logs an application produces. See the privacy notice for the full list.
Subprocessors
Who else touches the data
Two companies. We would rather name them plainly than leave you to guess which model is answering your questions.
Amazon Web Services
Hosting, database, storage and queues.
The account and its resources are in AWS regions we operate in.
OpenAI
Classifying crawled changes into signals, and generating the answers Ask AI returns.
Content we send for classification and answering is processed by OpenAI under their API terms. We do not have a separate arrangement beyond those terms, so please read them if that matters to your assessment.
To be exact about the part people usually ask about: crawled competitor content and the text of your Ask AI questions are sent to OpenAI’s API so that changes can be classified and answers written. We are not in a position to make promises about OpenAI’s own practices, so we do not make any. What they do with API content is set out in their terms, and that is the document to read.
Honesty
What we have not done yet
Every item here is something a procurement questionnaire will ask about and we cannot yet answer with a yes. Better you find out now than three weeks into a review.
- SOC 2
- No SOC 2 Type I or Type II report. No audit is under way, and there is no date to give you.
- ISO 27001
- Not certified, and not currently in the certification process.
- Third-party penetration test
- No external penetration test has been commissioned, so there is no report to share.
- HIPAA
- VeoCue is not built for protected health information and we will not sign a business associate agreement. Do not put patient data in it.
- Uptime service level agreement
- No contractual uptime commitment. We aim to keep the service up and we will tell you when it is not, but that is an intention, not an SLA.
- Customer-managed encryption keys
- Encryption uses AWS-managed keys. Bringing your own key is not supported.
If one of these is a hard requirement for you, say so early and we will tell you honestly whether waiting for us is sensible.
Reporting a problem
If you think you have found a vulnerability, write to security@veocue.com with enough detail to reproduce it. We will acknowledge it and tell you what we are doing about it. We do not run a paid bug bounty, and we will not take action against anyone who reports something in good faith.
The legal documents
All three are drafts pending legal review, and each says so at the top.