Security

How we protect your data.

Encryption at Rest

All data is encrypted at rest using AES-256. Database backups and file attachments are stored with server-side encryption enabled.

Encryption in Transit

All network traffic is encrypted with TLS 1.3. API endpoints enforce HTTPS, and HSTS headers are set on all responses.

SOC 2 Type II

Our infrastructure and processes are independently audited for security, availability, and confidentiality controls.

GDPR Compliant

We process data in accordance with GDPR requirements. Data export, deletion requests, and data processing agreements are supported.

SSO / SAML

Enterprise plans include single sign-on via SAML 2.0, letting you enforce your organization's authentication policies.

Audit Logging

Every mutation is logged with the user, timestamp, and affected resources. Business and Enterprise plans can export audit logs.

MCP Server Security

AI agent access is scoped with dedicated API keys (vel_mcp_ prefix), SHA-256 hashed storage, per-connection rate limiting (300 req/min), and read/write scope enforcement.

Report a Vulnerability

We take security seriously. If you discover a vulnerability, please report it responsibly so we can address it promptly.

security@velocity.quest