Security & trust
How we protect your data and your systems.
Entrusting a business process to a provider means knowing how it handles data, manages access, logs actions and responds to incidents. This page describes our practices, what is defined per project and what we do not claim.
- Framework
- Swiss FADP; GDPR where relevant.
- Certifications
- None to date. We prefer to say so.
- Questionnaires
- We answer your teams’ security questionnaires.
Principles
Automation should reduce risk, not automate it.
The level of control depends on the impact of an error: reading, modification, payment, deletion or irreversible action.
Least privilege
Each service, agent and account receives only the permissions it needs.
Server-side secrets
Keys and credentials are never exposed in a browser, a code repository or a log.
Targeted approval
Sensitive operations require explicit approval from an authorised person.
No duplicates
A retry after an error creates neither a second invoice nor a second order.
Traceability
Event, decision, actor and external effect remain traceable.
Emergency stop
A critical system can be stopped without losing pending items.
Data protection
The minimum data, in the right place, for the right length of time.
- Minimisation
- We only process the data the process needs. Sensitive data can be masked before any external processing.
- Location
- Where data is hosted and processed is defined per project and specified in writing. Hosting in Switzerland or on your infrastructure is possible.
- Encryption
- Encrypted communications, encrypted backups, encryption at rest depending on the chosen infrastructure.
- Retention
- Retention periods defined with you, followed by deletion or anonymisation.
- Roles
- For personal data processed on your behalf, VELLORNE acts as a processor; a data processing agreement can be concluded.
- Legal framework
- Swiss FADP, and GDPR where your activities are subject to it. No architecture is presented as compliant by default: compliance depends on actual use.
AI governance
AI is governed like any other critical component.
A language model can make mistakes. Our systems are designed on that basis.
- AI is only used when it brings measurable value; otherwise, rules.
- Every use is documented: model, provider, data transmitted, purpose.
- No model training on your data without your explicit consent.
- Verified outputs, confidence levels and source citations.
- Incoming content is treated as data, never as instructions.
- No binding decision is taken by AI alone.
- An automated assistant always identifies itself as such to people.
Access to your systems
Limited, named and revocable access.
- Dedicated technical accounts, never shared credentials.
- Permissions limited to the agreed scope, revocable at any time.
- Two-factor authentication on our administrative access, where the system allows it.
- Access logged and available for review.
- At the end of the engagement: access revoked, data returned or deleted as set out in the contract.
Reliability & incidents
Planning for incidents rather than hoping they won’t happen.
- Backups
- Encrypted, scheduled, with restore tests.
- Monitoring
- Errors, delays and silent failures detected and reported.
- Handling
- Detection, containment, diagnosis, fix, resumption without duplicates, report.
- Notification
- Any security incident affecting your data is reported to you as soon as possible.
Third-party services
You know who works with your data.
Some projects rely on third-party services: hosting provider, e-mail provider, AI model provider. For each project, we list these services, their role, the data concerned and their location before go-live. You decide what is acceptable.
For this website, data processing is described in the privacy policy.
Commitments
What is applied, what is decided per project, what we do not claim.
Applied by default
- Server-side secrets
- Least privilege
- Action logging
- Encrypted backups
- Human approval of binding actions
- Separate test environments
Depending on the project
- Hosting in Switzerland or on-premise
- Locally installed AI model
- Centralised authentication
- Data processing agreement
- Contractual response times
- Third-party security audit, at your request
What we do not claim
- An ISO 27001, SOC 2 or equivalent certification: VELLORNE does not hold one to date
- Automatic legal compliance
- Guaranteed availability without a contract defining it
- Absolute security: we reduce risks, we do not eliminate them
This site
The same principles, applied here.
- No third-party scripts, no advertising trackers.
- Audience measurement hosted by us, with no cookies and no stored IP addresses.
- Strict security headers and a restrictive content policy.
- Client area passwords stored as hashes, never in plain text.
- Contact requests kept for a limited period.
Found a vulnerability? Write to us at contact@vellorne.com before any public disclosure: we will acknowledge receipt and keep you informed.
Trust
A question from your IT manager or data protection officer?
We are happy to answer a security questionnaire or take part in an architecture review before any commitment.