Project-level access
One check gates viewing, search and citations.
Security & audit
Your documents carry pricing and means & methods. Vest keeps them yours, locked down by design. This page shows how that works, with sample data.
How your data is protected
Your own data vault
Your company's data lives in its own separate database, protected by row-level security, so the database itself checks who is asking before it returns anything. Your team sees it, and no other customer ever does.
Server-enforced access
If you can't open a project, Vest can't search it or cite it for you. Revoke access once and the AI loses it too.
Cited or silent
Every answer shows its source. No source, no answer. Vest won't guess.
No training on your data
Your documents, questions and answers never train anyone's models, including ours.
Where your data lives
Storage, databases and backups run in AWS us-east-1 (Northern Virginia). Every store is encrypted with AWS-managed keys; per-company keys are not built yet. AI providers process requests in their own infrastructure, listed by name in our subprocessor list.
Access you control
Every person has their own account and sees only their projects. Company SSO with MFA lands with pilot partners.
Complianceour posture, plainly
Only what's true today
We never claim a certification we don't hold. Certifications like SOC 2 are pursued when our customers' contracts call for them, and every gap we share comes with a date.
Security packet on request
Pilot partners get our written security summary: what's built, what's coming, and the dated plan for each gap.
Audit logdesign preview · sample rows
| When | Actor | Event | Project | Reference |
|---|---|---|---|---|
| Jul 1 · 2:14 PM | Daniel Reyes | Question answered: 2 citations returned | Northgate | conv_08f3 · msg_1a42 |
| Jul 1 · 2:14 PM | Vest | Citations validated: 2 of 2 present in retrieved evidence | Northgate | msg_1a42 |
| Jul 1 · 2:01 PM | Maria Chen | Document marked superseded: A9.2.1 Rev 1 | Northgate | doc_4410 |
| Jul 1 · 1:59 PM | Vest | Document processed: 9 pages, ready for answers | Northgate | doc_5521 |
| Jul 1 · 1:58 PM | Maria Chen | Document uploaded: Addendum 02.pdf | Northgate | doc_5521 |
| Jul 1 · 8:32 AM | Daniel Reyes | Signed in | — | session_77c1 |
| Jun 30 · 4:47 PM | T. AlvarezOPERATOR | Access-review report exported: operator action, customer-visible | All | export_9f12 |
| Jun 30 · 9:03 AM | Priya Patel | Project access granted by Project Admin M. Chen | Northgate | grant_3b90 |
Who can see what
Two roles
Admins manage access and documents. Members view and ask.
Database backstop
Even a software bug can't leak one project into another.
Operator discipline
We touch your data only for support you approve, and it's logged above.
The log is designed to store references, never document content, and to be append-only. Nothing can be edited or removed, including by us. Ask us for the current security packet.