Resources · Security & Trust
Built for your most
sensitive workloads.
Security is a property of the platform, not a feature bolted on. Data sovereignty, zero-trust access, AI guardrails and audit are enforced on every request, wherever you deploy.
Trust pillars
Six commitments,
enforced by design.
Your data stays where your mandate requires: on-prem, in your private or national cloud, or fully air-gapped.
Every request is authenticated and authorized: SSO, MFA and least-privilege roles.
Encrypted in transit and at rest, with managed secrets and key rotation.
Prompt-injection screening, PII redaction and clearance checks run on every AI request, in and out.
Isolated tenants with independent policies, quotas and data: row-level security and attribute-based access.
An audit ledger and traces record every significant event. Provable, not just logged.
Defense in depth
Security at every layer.
Controls are layered from the perimeter to the audit ledger, so a weakness in one layer is met by checks in the layers around it.
Perimeter
Identity & access
Data protection
AI guardrails
Assurance
Security operations
Defense as a daily practice.
Security here is operational, not theoretical: monitored boundaries, guarded access and traceable activity across the platform.
AI security
Governed AI, by default.
No application ever calls a model directly. Every AI request passes through the governed control plane, where policy is enforced before and after inference.
No Direct Model Calls
Applications call the AI Service Bus rather than models directly, so routing, policy checks and audit logging apply to requests on that path.
Prompt-Injection Screening
Inputs are screened for injection and manipulation before they reach a model.
PII Detection & Redaction
Sensitive data is detected and masked before the model sees it, and checked again on output.
Sensitivity Routing
Classified or sensitive workloads route only to permitted models, on-prem or air-gapped when required.
Human-in-the-Loop
Approval gates hold high-impact actions for a person to review before they execute.
Full Traceability
Every decision ties back to its inputs, policy and model on an audit trace.
Compliance & frameworks
Designed to support
your obligations.
The platform is built to help you meet recognized governance and security frameworks. Framework alignment supports your compliance program. It does not replace your own assessment.
Certification and attestation status, with supporting security documentation, is available on request as part of your evaluation — talk to our team.
Controls
The controls your
security team expects.
Sovereignty
Run it where your
data must live.
From public cloud to fully disconnected, on-host deployments: your models, your data, your jurisdiction.
Report a vulnerability
If you believe you've found a security issue, we want to hear from you. Email our security team at security@veevra.com with details and steps to reproduce, and we'll respond promptly.
Security documentation
We share our security overview, architecture and deployment details with prospective and existing customers under NDA. Request a copy and we'll set up a session with our security team.
Evaluating VEEVRA for a
regulated workload?
We'll walk your security and compliance teams through the model, controls and deployment options in detail.