Your strategy is your most sensitive asset
Vouli IQ holds the AI strategy of CXOs, GCC heads, and boards. It is engineered for strict per-organisation isolation, a stated data-residency region, and full auditability — with responsible-AI practices built into how it reasons.
Architectural controls
Security by architecture, not afterthought
Each control below is backed by code in the product. Nothing on this page describes a control we intend to build.
Tenant isolation
Per-organisation isolation on every request
Every request is scoped to your organisation by explicit organisation filters in our application code, enforced by an automated cross-tenant test that fails the build if a query loses its filter. Postgres row-level security is enabled on every tenant table as a second line of defence against direct database access. Your organisation is taken from the verified sign-in, never from anything a request supplies. A second CI gate fails the build if a tenant table ships without row-level security, and a two-tenant isolation test runs against a real Postgres built from the migration tree on every push.
No table the migration tree does not declare
Both isolation gates read the migration tree, so a table that exists only in a live database would be invisible to both. A provenance check compares the database against the migrations and reports anything it cannot account for, with reviewed exceptions carrying a reason and a review date.
Identity & access
Two-factor authentication your organisation can enforce
An administrator can require a second factor for everyone in the organisation. The check fails closed — if the policy cannot be read, access is refused rather than allowed — and a break-glass path keeps a locked-out administrator recoverable without weakening the policy for anyone else.
Roles checked on every request
Role-based access control scoped to the organisation (admin, contributor, viewer, and custom roles on the plans that include them), checked by the application on every request against the signed-in member’s role in their own organisation. A separate platform-operator role gates any cross-tenant operational view: its members are fixed in reviewed code, configuration can only narrow that list, and an operator address counts only once the identity provider has verified it.
Scoped API access
Programmatic access uses keys bound to a single organisation, with per-key rate limits, so an integration gets the access it needs and no more.
Data protection
Field encryption that fails closed
Regulated columns are encrypted with AES-256-GCM through a key-provider abstraction that supports a platform key or KMS envelope encryption. With no key configured the write fails loudly rather than silently storing plaintext.
A record of which key read your data
Every key-encryption-key operation the provider performs — minting a data key, unwrapping one — is recorded with its outcome and latency. Keys are identified by a SHA-256 prefix and never by the key id itself, so the log can be handed to an auditor without handing over anything that opens data.
Key rotation that resumes where it stopped
Re-encrypting a column is a long sweep that will be interrupted by a deploy or a timeout. Each run carries a cursor and checkpoints after every batch, so an interrupted rotation continues rather than restarting; a row that cannot be re-encrypted is reported with its identifier and keeps its previous value rather than being blanked.
Append-only audit trail
Sensitive actions are written to an audit log that is append-only at the database level and writable only by the service role — the evidence trail a SOC 2-grade review expects, which cannot be tidied up afterwards.
A statutory clock on every data-subject request
A subject access, erasure, rectification, portability or restriction request is logged against the date the SUBJECT asked — not the date somebody in the product got to it — and its deadline is computed under a named rule and stored. Identity must be verified before anything is released, a refusal must carry a lawful reason, and the whole handling is kept in an append-only trail.
AI governance
More than one model on board-grade output
On board-tier modules a council of independent models is convened and their disagreement is shown to every reader rather than resolved out of sight. It is conditional by design: it needs the second and third providers configured, and when it cannot convene the output says so instead of implying agreement.
Untrusted text is neutralised before a model sees it
Text that did not come from your own team — an uploaded document, an ingested record — passes through an injection filter and PII redaction before it reaches a model. No customer strategy data is used to train foundation models.
Continuous assurance
A content policy with the evidence to enforce it
The authenticated surface carries a nonce-based Content-Security-Policy. It ships in report-only mode and every refusal is aggregated into a durable store, so the decision to start blocking is made on a record of what has actually been refused rather than on hope.
Rate limits that fail closed
Sensitive routes are rate-limited by an atomic database counter. When the limiter itself cannot be reached the request is refused rather than admitted.
Data residency
Where your data lives
Every organisation is provisioned to a residency region. Today all customer data is stored in our Tokyo (AWS ap-northeast-1) cell; dedicated EU and India cells are on the Enterprise roadmap and are offered only once a cell is live.
Asia-Pacific (Tokyo)
ap-northeast-1
Platform default — all customer data is stored in AWS Tokyo today.
European Union
eu-central-1
For GDPR data-residency requirements — on the Enterprise roadmap; offered once the cell is live.
India
ap-south-1
For GCCs and India-domiciled enterprises with DPDP considerations — on the Enterprise roadmap; offered once the cell is live.
Compliance alignment
Built to help you meet the standards that matter
Vouli IQ is designed to help your organisation align to the frameworks below and produce board-ready evidence. Framework alignment supports your own compliance programme; it is not a substitute for independent certification.
NIST AI RMF
Risk modelling and the Compliance Engine map to the NIST AI Risk Management Framework.
ISO 42001
AI management-system practices aligned to the ISO/IEC 42001 standard.
SOC 2 principles
Audit logging and access controls designed around SOC 2 trust-service criteria.
GDPR
Privacy controls and scheduled-erasure execution to support GDPR obligations; a dedicated EU residency cell is on the roadmap.
India DPDP
Practices aligned to the India DPDP Act; a dedicated India residency cell is on the roadmap.
OWASP LLM Top 10
Responsible-AI guidance informed by the OWASP Top 10 for LLM applications.
Responsible AI
Intelligence you can defend
Transparency
AI outputs cite the frameworks and reasoning behind them, so recommendations are explainable at the board table.
Human in the loop
Vouli IQ informs decisions; it does not make them autonomously. Leaders remain accountable for every strategic call.
Provenance & versioning
Every AI output is versioned with its model, prompt context, and timestamp — a full provenance record over time.
Vulnerability disclosure
Found a security issue? Tell us — safely.
- Report privately to care@vouliiq.com (also published machine-readably at /.well-known/security.txt). Include steps to reproduce; please do not access data that is not yours.
- We acknowledge within 1 business day, keep you informed while we investigate, and credit reporters who wish to be named once a fix ships.
- Good-faith research is welcome. We will not pursue action against researchers who follow this policy, avoid privacy violations and service disruption, and give us reasonable time to remediate before public disclosure.
Have a security review? We'll meet it.
We're happy to walk your security and compliance teams through our architecture and controls.
Request a demoOr email care@vouliiq.com