# Trust Center | Vicaro > Vicaro security, data privacy, and AI governance: EU hosting, encryption, controls, subprocessors, and our security contact. Canonical: https://vicaro.com/trust-center # Vicaro Trust Center Security, data privacy, and governance for every AI employee. ## Compliance, at a glance. Current status, including audits still in progress. ### SOC 2 Type II Audit in progress Audit in progress with Scytale. No report has been issued yet. ### ISO/IEC 27001 Audit in progress Audit in progress with Scytale. No certificate has been issued yet. ### GDPR Compliant Our Privacy Policy explains lawful bases, data rights, and subprocessors. ### CCPA Compliant Our Privacy Policy explains California privacy rights. We do not sell personal information. ## Security & architecture. Where data lives, who processes it, and how AI employees are governed. ### Data protection - #### Hosted in the EU Compute, storage, and the database run in Frankfurt (eu-central-1). - #### Encrypted Keys, secrets, and integration credentials are encrypted at rest with AES-256. All data in transit uses TLS. ### Architecture - #### Subprocessors Ask our security team for the services that help us deliver Vicaro, where they process data, and which optional providers you can enable. - #### AI security controls Policies, human approvals, separate identities, and an audit trail govern what AI employees can do. ### Security in four layers ### Execution policies - #### Governance policies Define which actions agents may take. Allow, warn, require human approval, or block an action before it runs. - #### Guardrails Baseline protections govern tool connections, integration access, and policy changes. Add presets that fit your organization. - #### Prompt-injection protection Scan untrusted messages and tool results. Feed risk signals into policies to block suspicious content or require approval. - #### Kill switch Say “stop” to halt a running task. Pause an agent to prevent new messages and scheduled work from starting. ### Identity & access - #### Accountable human Every agent has a named manager who sets direction and can approve or deny sensitive actions. - #### Separate agent identities Provision separate identities and credentials for agents. Keep their access distinct from human accounts. - #### Communication controls Choose who can reach each agent, internally and externally. Restrict access to specific people and channels. - #### Org-wide controls Apply policies across every agent. Organization-level restrictions cannot be loosened by an individual agent’s rules. ### Data & providers - #### Full auditability Review actions, policy decisions, and configuration changes in a tamper-evident audit log. Export records for independent review. - #### No training by default. You own your data. Training-data collection is off by default. Your organization controls whether to explicitly opt in. - #### Full provider control Choose approved model vendors, pin models per capability, and disable providers your organization does not allow. - #### Data-flow transparency Inspect provider and model choices, review subprocessors, and restrict processing to providers you approve. ### Infrastructure & limits - #### Budgets & cost controls Set spend caps per agent and scheduled task. Track usage and stop work when a limit is reached. - #### Bring your own keys Use your own model-provider credentials so inference runs under your account and commercial terms. - #### Dedicated tenants Choose a dedicated data plane with isolated storage, secrets, and independently revocable tenant access. - #### Multi-cloud & BYOC deployment Deploy a dedicated data plane in your own AWS or Google Cloud account and chosen region, with private networking and encryption keys you control. [### Security measures Access, confidentiality, incident response, retention. Read](https://vicaro.com/trust/security-measures) [### AI security controls Policies, approvals, isolation, audit. Read](https://vicaro.com/trust/ai-security-controls) ## Documents for each stage. Public policies are here to read. Ask our security team for agreements. ### Prospect evaluation Review the public terms while you evaluate Vicaro. - [Terms of Service](https://vicaro.com/terms) · Public document - [POC agreement](mailto:security@vicaro.ai?subject=Vicaro%20legal%20document%20request%3A%20POC%20agreement) · Request a copy by email - [Evaluation terms](mailto:security@vicaro.ai?subject=Vicaro%20legal%20document%20request%3A%20Evaluation%20terms) · Request a copy by email ### Customer activation Privacy terms and agreements for an ongoing partnership. - [Privacy Policy](https://vicaro.com/privacy) · Public document - [Mutual NDA](mailto:security@vicaro.ai?subject=Vicaro%20legal%20document%20request%3A%20Mutual%20NDA) · Request a copy by email - [Data Processing Addendum](mailto:security@vicaro.ai?subject=Vicaro%20legal%20document%20request%3A%20Data%20Processing%20Addendum) · Request a copy by email ## Talk to our security team. Questionnaires, audits, and vulnerability reports. ### Security reviews Send your questionnaire or audit request. Implementation detail is shared under NDA. ### Report a vulnerability Email the details and steps to reproduce. Please give us time to fix it before sharing it. security@vicaro.ai [Gmail](https://mail.google.com/mail/?view=cm&fs=1&to=security%40vicaro.ai&su=Security%20question) · [Outlook](https://outlook.office.com/mail/deeplink/compose?to=security%40vicaro.ai&subject=Security%20question) · [Mail app](mailto:security@vicaro.ai?subject=Security%20question) ## What would you hand over first? Start with one role and one real task. [Apply for access](https://vicaro.com/apply) · [Book a demo](https://vicaro.com/contact-sales)