Your data stays out of it
The Containment Assessment runs in a sandbox, on synthetic or scrubbed data. We never take production data in that engagement, and we sign a mutual NDA before it starts. You receive the full audit logs from every test run at handoff.
Access is yours to grant and to end
Any access we need to support you is approved by you and limited by time. We don't hold standing access to client environments. When the work is done, the door closes. Pilot deployments are designed to run inside your own VPC or on-premises environment, so the reasoning your agents produce stays inside your walls.
Every intervention leaves a record
When VitreousAI™ steps in, it writes an immutable audit record: what the agent attempted, which boundary it met, and what the system did about it. Your auditors can read it without needing us in the room.
The policies are written down
We operate under eight written internal policies: information security, access control, incident response, change management, data retention and disposal, vendor management, business continuity and disaster recovery, and acceptable use. They were written for this company, reviewed when it incorporated, and they get reviewed again whenever its structure changes.
Where we are on SOC 2
SOC 2 Type 2 preparation is underway. We're not certified today. When that changes, this page will say so, with the date and the auditor. Until then, if anyone tells you VitreousAI™ holds a certification it hasn't earned, the answer is no.
Questions
Security and procurement teams ask hard questions, and they should. Send yours through the request form and Rocky will answer personally.