Security
Security and data protection
Built for your IT, security and vendor-risk reviewers.
At a glance
Controls enforced where the data lives.
Strict tenant isolation
Each customer's data is isolated, enforced by database row-level security.
Encryption
Data is encrypted in transit and at rest.
Hash-chained audit trail
Every governed event is chained and verifiable; audit records can't be edited.
Role-based approvals
Ordered approval steps, scoped by role, facility and field.
Hosted on AWS
Vellum runs on Amazon Web Services infrastructure.
BAA available on request
We sign a business associate agreement where your use requires one.
Under the hood
For IT and vendor-risk review.
Technical detail behind the capabilities above.
- Tenant isolation
- PostgreSQL row-level security on every tenant-owned table, with tenant context set per transaction.
- Permission model
- Permissions combine role, resource, action, facility, data type, field and workflow step, evaluated on the server. Self-escalation is blocked.
- Controlled writes
- Regulated changes go through database functions that authorize the actor, append audit events and record outbound integration events in one transaction.
- Audit chain
- Gapless, per-tenant SHA-256 sequence with canonical serialization; audit updates and deletes are blocked; verifiable at any time.
- Integration events
- Stored durably in a transactional outbox in the same transaction as the change, with claim, retry and dead-letter handling, and delivered through Vellum's integration layer.
- Secrets
- Endpoint credentials are held as secret references, never stored in Vellum configuration.
- Hosting and encryption
- Hosted on AWS; data encrypted in transit and at rest. BAA available on request.
Questions from your IT or security team?
Request a briefing and we'll bring the right people, or email hello@vellum.group.