Security
Last updated:
The controls in place today, what we keep and for how long, and answers to the questions security reviews ask most.
On this page
Controls
- Access control
- Every staff login uses Google Workspace with 2-step verification enforced.
- Access to customer data is limited to company officers and named support staff. The admin console sits behind Cloudflare Access, and group membership is managed as code with daily drift checks.
- Every admin change and admin read of customer data is recorded in an append-only audit log naming the staff member.
- API keys and OAuth tokens are stored only as SHA-256 hashes.
- Encryption
- HTTPS (TLS) for all traffic and database connections, with HSTS on vamotalent.ai.
- Data at rest is encrypted with AES-256 by our infrastructure providers.
- Isolation
- Code submitted through the MCP server runs in a fresh, single-use Cloudflare isolate with no network access and no credentials.
- Staging environments sit behind Cloudflare Access, and public preview URLs are disabled.
- Data use
- Search queries and results are never kept.
- Customer data is never used to train models, ours or our providers.
- Change management
- Every change ships through a pull request with automated tests, a staging environment, a controlled release, smoke tests and rollback.
- Logging
- Staff sign-in records and infrastructure log metadata are kept for 365 days.
- Incident response
- We notify customers within 72 hours of confirming a breach that affects their data.
- Vendors
- Core infrastructure providers hold SOC 2 Type II reports.
Data retention
Everything Vamo keeps, how long, and why.
| Data | Kept | Why |
|---|---|---|
| Search queries and results | Never kept | Processed in memory and returned to you, then discarded. |
| Code submitted through the MCP server | Not stored | Runs once in a single-use sandbox and is never logged. |
| AI assistant conversations | Never received | The MCP server only receives tool calls. |
| Large MCP results | 15 minutes | Held so one large result can be paged. |
| Request logs | 7 days | Method, path, status and timing, for debugging. |
| Usage log | 90 days | Endpoint, time, status and credits used, for support. No query content. |
| Enrichment records | For the term, or shorter on request | So enriching the same profile again is not charged twice. |
| Account details | Life of the account | Name, work email, organization, team and roles, to run your account. |
| API keys and access tokens | Until revoked | Stored only as SHA-256 hashes. The full key is shown once. |
| Billing records | As required for accounting | Plan, invoices and credits. Card details stay with Stripe. |
Security questions
Where is our data hosted?
Vamo runs on Cloudflare Workers. Our API and MCP servers are pinned to the AWS us-east-1 region, next to our primary database, Neon Postgres, also in AWS us-east-1.
How is data encrypted?
All connections use TLS, including database connections, and HSTS is on for vamotalent.ai. Stored data is encrypted at rest with AES-256 by Cloudflare and Neon. API keys and OAuth tokens are stored only as hashes.
Who at Vamo can access our data, and is MFA required?
Every staff login uses Google Workspace with 2-step verification required. Access to customer data is limited to company officers and named support staff, behind Cloudflare Access, and every admin change and read is written to an append-only audit log.
How is the MCP code sandbox isolated?
Code your AI assistant submits runs in a fresh, single-use Cloudflare isolate for each call, with no network access and no credentials. It can only call the Vamo API with your own permissions, and the code is never logged or stored. The MCP server receives tool calls only and never sees your assistant conversation.
Are our search queries and results kept?
No. Search queries and results are never kept. They are processed in memory and returned to you. See the retention table for everything we do keep and for how long.
Is our data used to train models?
No. Nothing you send to Vamo is used to train models, ours or our providers.
How fast would you notify us of a breach?
Within 72 hours of confirming a breach that affects your data, with what happened, what data was involved and what we are doing about it.
Do you have a SOC 2 report or a penetration test?
Not yet. Our core infrastructure providers hold SOC 2 Type II reports, and we are happy to complete your security questionnaire.