SOC 2 Type II
Audit in progressAudit in progress with Scytale. No report has been issued yet.
Vicaro Trust Center
Security, data privacy, and governance for every AI employee.
Compliance,
at a glance.
Current status, including audits still in progress.
ISO/IEC 27001
Audit in progressAudit in progress with Scytale. No certificate has been issued yet.
GDPR
CompliantOur Privacy Policy explains lawful bases, data rights, and subprocessors.
CCPA
CompliantOur Privacy Policy explains California privacy rights. We do not sell personal information.
Security &
architecture.
Where data lives, who processes it, and how AI employees are governed.
Data protection
Hosted in the EU
Compute, storage, and the database run in Frankfurt (eu-central-1).
Encrypted
Keys, secrets, and integration credentials are encrypted at rest with AES-256. All data in transit uses TLS.
Architecture
Subprocessors
Ask our security team for the services that help us deliver Vicaro, where they process data, and which optional providers you can enable.
AI security controls
Policies, human approvals, separate identities, and an audit trail govern what AI employees can do.
Security in four layers
Execution policies
Governance policies
Define which actions agents may take. Allow, warn, require human approval, or block an action before it runs.
Guardrails
Baseline protections govern tool connections, integration access, and policy changes. Add presets that fit your organization.
Prompt-injection protection
Scan untrusted messages and tool results. Feed risk signals into policies to block suspicious content or require approval.
Kill switch
Say “stop” to halt a running task. Pause an agent to prevent new messages and scheduled work from starting.
Identity & access
Accountable human
Every agent has a named manager who sets direction and can approve or deny sensitive actions.
Separate agent identities
Provision separate identities and credentials for agents. Keep their access distinct from human accounts.
Communication controls
Choose who can reach each agent, internally and externally. Restrict access to specific people and channels.
Org-wide controls
Apply policies across every agent. Organization-level restrictions cannot be loosened by an individual agent’s rules.
Data & providers
Full auditability
Review actions, policy decisions, and configuration changes in a tamper-evident audit log. Export records for independent review.
No training by default. You own your data.
Training-data collection is off by default. Your organization controls whether to explicitly opt in.
Full provider control
Choose approved model vendors, pin models per capability, and disable providers your organization does not allow.
Data-flow transparency
Inspect provider and model choices, review subprocessors, and restrict processing to providers you approve.
Infrastructure & limits
Budgets & cost controls
Set spend caps per agent and scheduled task. Track usage and stop work when a limit is reached.
Bring your own keys
Use your own model-provider credentials so inference runs under your account and commercial terms.
Dedicated tenants
Choose a dedicated data plane with isolated storage, secrets, and independently revocable tenant access.
Multi-cloud & BYOC deployment
Deploy a dedicated data plane in your own AWS or Google Cloud account and chosen region, with private networking and encryption keys you control.
Documents for
each stage.
Public policies are here to read. Ask our security team for agreements.
Prospect evaluation
Review the public terms while you evaluate Vicaro.
- Terms of Service Public document
- POC agreement Request a copy by email
- Evaluation terms Request a copy by email
Customer activation
Privacy terms and agreements for an ongoing partnership.
- Privacy Policy Public document
- Mutual NDA Request a copy by email
- Data Processing Addendum Request a copy by email
Talk to our
security team.
Questionnaires, audits, and vulnerability reports.
Security reviews
Send your questionnaire or audit request. Implementation detail is shared under NDA.
Report a vulnerability
Email the details and steps to reproduce. Please give us time to fix it before sharing it.
What would you hand over first?
Start with one role and one real task.