Trust

Security and deployment

Veris is SOC 2 Type II audited, meets HIPAA requirements and is GDPR compliant. It runs as SaaS, or fully on-prem inside your own VPC on AWS, GCP or Azure. Simulations run on synthetic data by default, and the agent under test is reached the way production reaches it, with nothing it touches being real.

Updated 20 October 2026

Certifications and commitments

  • SOC 2 Type II, audited under the AICPA framework. The report is available under NDA.
  • HIPAA requirements met.
  • GDPR compliant.

Every simulation is sealed from production by construction: the agent's tool calls reach twins, the people it talks to are simulated, and the records it changes exist only inside the run.

Two ways to deploy

SaaS

The platform runs in Veris's cloud. It needs no infrastructure on your side, which makes it the place to start: synthetic data, and an agent in a dev or test environment. No production data and no production systems are involved.

Fully on-prem, inside your VPC

The whole platform runs inside your own cloud project on AWS, GCP or Azure: the twins, the simulated users, the runs and the evidence. Deployment usually takes a couple of days before an engagement starts. An air-gapped install is available for environments that allow no egress.

Starting on SaaS to evaluate and moving in-house for production use is a common path.

What touches your data

  • Synthetic by default. Worlds are generated from your policies, process maps and schemas, not from customer records.
  • A masked sample when needed. When a twin should sit closer to your real data shapes, a small masked export approved by your data office seeds it once.
  • The agent is a black box. Veris reaches it through its endpoint, a container you ship, or a managed harness. No source access is needed for a product you did not build, and your own agent keeps calling whatever models it calls today.
  • Credentials stay out of the record. Request traces redact credentials, and API keys are shown once and stored only as a hash.
  • Evidence stays with you. In an on-prem deployment, transcripts, traces and ledgers never leave your project. In SaaS they are yours to export through the API.

What a security review receives

Enterprise reviews ask for the same set, and we send it at the start rather than the end: the SOC 2 Type II report under NDA, completed security questionnaires, our data processing terms, and a description of the deployment option you are evaluating. For on-prem deployments, the container images are delivered for scanning before anything is installed.

Questions

Can Veris run entirely inside our VPC?
Yes. The fully on-prem option runs every part of the platform inside your project on AWS, GCP or Azure, and an air-gapped install is available where no egress is allowed.
Do you need our production data?
No. Simulations run on synthetic data by default. A small masked sample, approved by your data office, is used only when a twin should sit closer to your real data shapes.
Who sees our prompts, tools and code?
In an on-prem deployment, nobody outside your organisation: the platform runs in your project. In SaaS, the agent stays wherever it runs today and Veris calls it through its endpoint, so prompts and code stay with you.
Does the agent need to change?
No. The agent connects the way production connects to it. Its tool calls are routed to the twins for the duration of a run, and nothing inside it is modified.
Where do model calls go?
Your own agent keeps using the model providers it uses today. Managed harnesses that Veris runs as baselines use the providers configured for your deployment.

Start the review early

Book a demo and ask for the security pack in the same message. The SOC 2 report, the questionnaires and the deployment description go out at the start of an evaluation, not the end.

Book a demo