Security & trust
Safe by design, not by promise.
Operations that run themselves only work if you stay in control. Vantiqo works inside a permissions boundary that you control, keeps every workspace's data separate under its own encryption key, and records every change — the AI suggests, people decide.
Access to your cloud
Read-mostly access, inside a guardrail you control.
Connect AWS with a CloudFormation stack — no access keys. Vantiqo's role is capped by the VantiqoBoundary guardrail, which you can inspect and which Vantiqo can't change.
- Blocks creating identities and keys and passing other roles
- Blocks reading S3 objects, secret values and private parameters
- Blocks Organizations changes and changing the guardrail itself
- Other clouds connect with read-only tokens
Your data
Your data, kept apart and locked.
A database per workspace
Each workspace has its own database, kept in its data region.
An encryption key per workspace
Each workspace's secrets are sealed with its own key, protected by AWS KMS.
Secrets never shown again
Once saved, a secret isn't sent back to the browser — not to you, not to us.
Backups with restore tests
Nightly encrypted backups, with restores tested.
Every change audited
Every change is in the audit log, with approvals for risky actions on production accounts.
Signed webhooks
Outgoing webhooks are signed, and only sent to public HTTPS addresses.
People and access
Strong sign-in, and support only when you say so.
Vantiqo staff only enter your workspace through time-limited support access that you can see and end at any time.
- Roles (viewer, operator, admin) and users limited to specific accounts
- Passkeys, two-factor for admins or everyone, and recovery codes
- SSO, IP allowlists and API tokens
- Agents connect out only and run only repairs built into them
Good to know
Straight answers.
Is Vantiqo SOC 2 or ISO 27001 certified?
No. Vantiqo helps you prepare for these audits with live control scores and evidence reports; Vantiqo itself is not certified.
Can Vantiqo read my data?
Vantiqo has read-mostly access to your configuration, inside a guardrail that blocks reading S3 objects, secret values and private parameters.
Where can I see the service status?
On the public status page. See also the Privacy Policy, Data Processing Agreement and sub-processors.
See it on your own cloud.
Start a free trial and connect your first account in minutes — or talk to us first.