Security and trust
What we do, and what we have not done yet.
Security pages usually list what a vendor is proud of. This one also lists what is outstanding, because your security review will find it anyway and it is cheaper for both of us if you find it here.
One thing worth being explicit about, since Version X is a team rather than a filing cabinet: the question your review needs answered is not only where the data sits, but what the agents are allowed to do with it. The controls below are the answer, and the approval gate is the important one.
Not yet achieved
ISO 27001 and SOC 2 are a roadmap goal, not current certifications. We are not certified against either today. Any supplier questionnaire asking us to confirm certification gets that answer in writing. The published privacy notice, terms and DPA are also still being finalised with our advisers, and are available on request in the meantime.
In place today
Access control
Role tiers apply across every module rather than being configured per tool. Launch has two tiers; Scale and Suite have the full set. Suite adds single sign-on over SAML.
Audit logging
Actions are recorded with who, what and when. Retention is 30 days on Launch, one year on Scale and unlimited on Suite.
Approval gates on AI
Anything Ori does that spans more than one record pauses for human approval rather than writing silently. This applies during migration as well as in normal use.
One database, one export
Because records live in one place rather than nine, a complete export of your data is possible. That is a security property as much as a convenience one.
Sub-processors published
The third parties that process data on our behalf are listed, with what each one handles and the evidence that it is actually in use.
Isolation on Custom
Dedicated or self-hosted infrastructure in your own cloud environment, with security configured to your own review rather than to a standard plan.
Reporting a vulnerability
Write to hello@versionx.co with the subject line “Security”. Tell us what you found and how to reproduce it. We will acknowledge within two working days. Please do not test against other customers’ data or run denial-of-service traffic, and give us reasonable time to fix an issue before publishing it.