Security Overview and Sub-processors
Effective date: May 25, 2026 | Last updated: May 25, 2026
1. Deployment Options
Vouchstone offers three deployment models so customers can match security controls to risk.
| Model | Where customer data resides | Who operates it |
|---|---|---|
| Hosted (Platform and Enterprise) | Vouchstone-managed AWS environment, United States (us-east-1) | Vouchstone |
| Data plane in customer cloud | Customer's AWS, Google Cloud or Azure account; Vouchstone control plane holds account and billing metadata only | Shared |
| Self-hosted and air-gapped (perpetual or term licence) | Entirely in the customer's VPC or data centre, with optional self-hosted models and no external calls | Customer |
2. Data Protection
- Encryption in transit using TLS 1.2 or higher (TLS 1.3 preferred) and at rest using AES-256.
- Logical tenant isolation, with agents scoped to their own sub-graph and permitted data only.
- Customer Data is not used to train general-purpose AI models.
- Secrets and connector credentials are stored in encrypted secret stores with restricted access.
3. Access Control
- Single sign-on and multi-factor authentication for customers on eligible plans; mandatory MFA for Vouchstone staff.
- Role-based, least-privilege access for staff, with production access limited to authorized engineers and reviewed quarterly.
- Customer-configurable roles, agent autonomy levels and human-approval gates.
4. Auditability and Monitoring
- Every agent decision can be recorded to a signed, hash-chained audit ledger that customers can export and replay.
- Centralized logging and monitoring of infrastructure and application events, with alerting for suspicious activity.
- Administrative actions in the platform are logged.
5. Secure Development and Operations
- Code review, dependency scanning and secret scanning before release.
- Separation of development, staging and production environments.
- Regular vulnerability scanning and third-party penetration testing, with remediation tracked to closure.
- Automated backups with encryption and tested restoration procedures.
6. Incident Response
Vouchstone maintains an incident response plan with defined roles, severity levels and communication procedures. We notify affected customers of a security breach affecting their Customer Data without undue delay and within 72 hours of becoming aware of it.
7. Security Reviews
Customers and prospects may request our security questionnaire responses and further details of our controls under a confidentiality agreement by emailing admin@vouchstone.ai. Vouchstone does not represent that use of the Services satisfies any particular regulatory or compliance framework; customers remain responsible for their own compliance.
8. Sub-processors
Vouchstone uses the following sub-processors to provide the hosted Services. Self-hosted and air-gapped deployments do not use Vouchstone sub-processors for customer data.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, storage and infrastructure | Customer Data, account data, logs | United States |
| Anthropic, PBC | LLM inference for extraction, reasoning and agents (no training on customer data) | Customer Data submitted in prompts | United States |
| OpenAI, L.L.C. | LLM inference for extraction, reasoning and agents (no training on customer data) | Customer Data submitted in prompts | United States |
Vouchstone routes AI tasks among the model providers listed above and may use any of them for a given task. Any new model provider will be added to this list, with at least 30 days' notice, before it processes customer data. Model providers that a customer chooses to connect using its own account or API keys are the customer's own providers and are not Vouchstone sub-processors.
We will give at least 30 days' notice of new sub-processors by updating this list. To receive notices, email privacy@vouchstone.ai with the subject "Sub-processor updates."
9. Responsible Disclosure
If you believe you have found a security vulnerability, email admin@vouchstone.ai with the subject "Security." Please give us reasonable time to fix the issue before public disclosure, and do not access, modify or delete other users' data. We will not pursue legal action against good-faith research that follows these guidelines.
Vouchstone LLC, 2000 Walnut Ave, Fremont, California 94538, United States