The same runtime governance, evidence chains, and identity guarantees Veldt ships to customers. We run internally, first.
Last updated: 2026-07-09v1.0
Our approach
Veldt was built because governance and evidence were broken. Enterprises could tell you what an agent did after the fact, sometimes; they could rarely prove why it was allowed, who authorized it, or that the record hadn’t been touched. That gap is our product.
We eat our own product. Every internal action that matters — a production deploy, a secret rotation, a config change, an access grant — flows through the same runtime gate that customers use. When we say every action is scored, attributed, and recorded to a signed evidence chain, we mean ours too.
Encryption
Data at rest. AES-256 across all data stores, KMS-backed, with per-tenant keys for customer data. Key material is HSM-protected; rotation policies are enforced by the platform, not by convention.
Data in transit. TLS 1.3 for all external traffic. Backend service-to-service calls use certificate pinning and mutual TLS with short-lived, workload-issued certificates.
Evidence chains. SHA-256 content hashing with Ed25519 signatures. Every record is verifiable offline against the public key, without contacting Veldt infrastructure.
Secrets. No long-lived credentials. Access to production resources uses short-TTL tokens issued via workload identity federation. Human access uses hardware-backed keys.
Identity & access
MFA required. Hardware-key MFA is mandatory for all Veldt personnel with production access. There is no bypass path for convenience.
Least privilege by default. Standing production access is off. Elevation is just-in-time, scoped to task, peer-approved, and time-bounded.
Gated by our own runtime. Every internal action against production — whether by human or automation — passes through the same runtime governance layer we sell.
Quarterly access reviews. Reviews are logged to the signed audit chain. Anomalies are triaged; entitlement drift is corrected on cadence.
Infrastructure
Cloud. AWS and GCP, multi-region for redundancy. No customer data is stored on developer endpoints.
Network isolation. One VPC per environment. Compute lives in private subnets. Egress is restricted through allowlisted proxies with logged traffic.
Kubernetes hardening. A single hardened image baseline. Admission policies block privileged and non-root-required workloads. No root in containers. Signed images only, verified at admission.
Backups. Encrypted, retained per data-class policy, geographically separated from primary storage. Restores are tested on a documented cadence, not left to the day of an incident.
Compliance & attestations
Current status as of the “Last updated” date above. Reach out to [email protected] for the current report inventory, SOC 2 bridge letters, or a customer-security questionnaire.
SOC 2 Type IIIn progress — Q4 2026
ISO 27001Planned — 2027
HIPAASupported — BAA available for eligible customers
GDPRIn scope — DPA available
PCI DSSNot applicable — no cardholder data processed
Vulnerability disclosure
We welcome responsible disclosure. If you believe you’ve found a security issue in Veldt Labs infrastructure, our marketing site, or the Veldt platform, please report it directly.
We publish a status log for critical CVEs affecting Veldt or its declared dependencies. We do not test, retaliate against, or pursue legal action against good-faith researchers who follow this policy.
Incident response
24/7 on-call rotation. A named on-call engineer is available at all times, with backups. Escalation paths are drilled, not documented-and-hoped.
Runbook-driven playbooks. Response follows written procedures. Every incident produces a signed post-mortem entered into the audit chain.
Customer notification. For confirmed data-affecting incidents, customers are notified within 72 hours of confirmation, with facts as known and updates as they develop.