Controls we have implemented, and certifications we have not
These are two different things, and most vendor sites present them as one. This page keeps them apart, because the people reading it are paid to tell the difference.
Implemented
Controls in the product today
Each of these is a property of the running system and can be demonstrated.
Tenant isolation
Enforced with row-level security in the database. Authorisation is not a property of the interface, so a client defect cannot become a cross-tenant disclosure.
Site-level authorisation
Access is granted per site rather than per organisation, so a person sees the estate they operate and not everything the tenant holds.
Audited operational actions
Consequential actions are recorded as auditable events, which is what makes after-action review evidence rather than recollection.
AI execution controls
Per-tenant policy, enforced per-user budgets and a tool authorisation boundary by risk class, applied before execution rather than as post-hoc filtering.
Consent handling for messaging
Outbound SMS carries consent capture and opt-out handling, recorded against the recipient.
External certifications
Virtik does not currently hold SOC 2, ISO 27001, HIPAA or FedRAMP certification, and you will not find those marks anywhere on this site.
Certification status is confirmed directly and in writing during evaluation. If a certification is obtained it will be listed here with its scope and date — as a statement, not a badge, because scope is the part that actually matters to your assessment. Deployment and data-location requirements are discussed during an enterprise evaluation; Virtik makes no commitment on hosting region or data residency unless an executed Order Form states one.
We would rather you learn this here than discover it midway through a security review.
For an assessment
A direct technical session covering the authorisation model, tenant boundary, data handling and AI controls is usually faster than a document exchange — and gets you a defensible answer rather than a marketing one.
Trust Center
What is being published next
A dedicated trust surface at trust.virtik.ai, covering the sections below.
- Security overview
- Architecture
- Authentication
- Encryption
- Access controls
- Data handling
- Subprocessors
- Privacy
- Data processing agreement
- Responsible AI
- Vulnerability disclosure
- Security advisories
- Security documentation
A security package request will sit alongside these. It will route to a person rather than auto-deliver a document, because a package that has not been assembled cannot be sent — and pretending otherwise wastes an evaluator's time.
Legal documents — privacy policy, terms and the data processing agreement — are published once Virtik has finalised and approved them. We have deliberately not drafted placeholder legal text.