Everything you need to assess us, including what is missing
You are reading this because your job is verifying claims. So each item below carries its real state — published, pending, or available on request — rather than being listed as though it were all finished.
Index
Posture, governance and legal
Four of these are published today. Four are not, and are marked as such.
- PublishedSecurity architectureTenant isolation, dual-gate authorisation, governed AI execution and audited actions — stated as architecture.
- PublishedIdentity & accessAuthentication, multi-factor, and the separation between administrative and operational surfaces. Documented as part of the security architecture.
- PublishedData protectionWhere the tenant boundary is enforced and what that means for customer data. Documented as part of the security architecture.
- PendingInfrastructureHosting, regions, network boundaries and backup posture. Not published — this requires a verified statement of the production estate, not a description of it from memory.
- PendingIncident responseHow a security incident is detected, escalated and communicated to customers, including notification timelines. Not published — the timelines are a commitment, and no approved one exists yet.
- PublishedResponsible AIHow AI execution is bounded: operating modes, per-tenant policy, enforced budgets and a tool authorisation boundary.
- PublishedVulnerability disclosureHow to report a suspected vulnerability, and what we commit to in return.
- PublishedCompliance & data handlingImplemented controls, and an explicit statement of which certifications are not held.
- PendingPrivacy policyHow data is collected, processed and retained.
- PendingData processing agreementThe DPA for customers processing personal data through the platform.
- PendingSubprocessorsThird parties involved in delivering the service, and what each one handles.
- PendingSystem statusLive availability of production services. Published only once a real probe exists behind each service.
Requesting a security package
A request routes to a person rather than triggering an automatic download. That is deliberate: a package that has not been assembled cannot be sent, and an auto-reply promising one wastes an evaluator's time more than a direct answer costs them.
For most assessments a technical session is faster than a document exchange — we can walk the authorisation model, the tenant boundary and the AI execution controls against your actual requirements.
Two routes
A dedicated trust surface at trust.virtik.ai is planned. Until it exists, this page is the index.