Our approach
Autonomous systems act inside your infrastructure, so security has to be designed in from the first line. This page describes what we do today, separated by what it applies to: the veli(Q CRM product, the bespoke AI systems we build for clients, and how we work. Where something depends on the engagement, we say so, and we put what we agree in your written Order.
We would rather give you an accurate answer than an impressive one. If a control you need is not listed here, ask. We will tell you plainly whether it exists, whether we can build it, or whether it is a gap.
veli(Q CRM
Our CRM holds your customers' details, so it is a multi-tenant application with protection at the database level, not only in the interface.
- Workspace isolation: every table is isolated per organisation using row-level security enforced by the database itself, so one workspace cannot read another's records even if the application layer is bypassed. The isolation rules are tested automatically on every code change.
- Roles and permissions: people join a workspace by invitation (invitations expire) and act with the role and feature permissions their administrator assigns.
- Authentication: sign-in is handled by a managed authentication service, and passwords are never stored in readable form. Accounts support two-factor authentication, and sensitive administrator actions such as exporting workspace data or resetting a member's password require a second factor.
- Access controls: workspace administrators can restrict sign-in to approved IP addresses. API keys default to read-only with an expiry date.
- Hardened web layer: encrypted HTTPS connections with HSTS, a Content Security Policy, clickjacking protection and rate limiting on public forms and APIs. Internal database functions are locked down and are not callable from the public interface.
- AI features under your control: AI features can be switched off per workspace or per person. When used, requests are sent with provider-side storage disabled, recognisable secrets are masked first, and we never use Customer Data to train AI models. See the Privacy Policy.
- Accountability: privileged platform-operator activity, including any impersonation of a customer account, is recorded in an audit trail, and deleted records go to a recycle bin before they are removed.
- Your data stays yours: we process it only to provide the CRM on your instructions and never sell it. Workspace administrators can export their data, and when a customer leaves, its workspace is permanently deleted through a deliberate two-step process with a waiting period. See the Terms of Service.
Bespoke AI systems we build
For systems built for a client, security is scoped during design: we document data flows, permissions, approval thresholds and retention rules, and you review and sign them off before anything runs in production.
- Least privilege: systems authenticate to your infrastructure with dedicated service accounts or OAuth scopes, never shared human credentials, and receive only the access their workflow needs.
- Human approval gates: payments, refunds, outbound messages and record changes above thresholds you set can wait for a person to approve.
- Hard limits: systems can only use the tools and actions they are configured for, with caps on amounts, volumes and frequency.
- Prompt-injection defence: content from emails, documents and websites is treated as untrusted data, not instructions, and high-risk actions require confirmation.
- Logging: inputs, tool calls and outputs are logged so you can answer what happened and why, with retention agreed in the Order.
- Evaluation: each system has a test set of real scenarios that is run before a release.
- Transparency: customer-facing systems identify themselves as AI and offer a route to a person.
- Data minimisation: systems access only the fields a task needs, with optional masking of personal identifiers before data reaches a model.
Model providers and your data
Our products and systems use AI models from established third-party providers through commercial interfaces. We send only the data a request needs, and we configure requests so the provider does not store the conversation where it allows that. Under the commercial terms we use, providers do not train their models on this data by default, although a provider may keep request data for a limited period for abuse monitoring unless a zero-retention arrangement applies. Where a client needs a specific provider, region or deployment model, we assess it during scoping.
Infrastructure and engineering
- Our products run on managed cloud platforms operated by established providers, with traffic encrypted in transit and data encrypted at rest by the infrastructure.
- Secrets such as API keys are kept in managed secret stores, not in source code.
- Dependencies are audited automatically on every code change, and database security tests run in our build pipeline.
- Data-residency requirements are assessed with you during scoping.
Assurance and current status
We reviewed the CRM's code, access rules and live database configuration in October 2026 and addressed the findings in code. We have not yet completed an independent penetration test or a third-party certification such as SOC 2 or ISO 27001. If your procurement requires one, tell us at the start and we will be straightforward about timing and alternatives, such as a security questionnaire, a call with our engineers or a data processing agreement.
Incident response
If a security incident affects your data, we will tell you without undue delay and within the period that applicable law or your agreement requires, investigate, contain and remediate it, and support any notification duties you have, such as the 72-hour breach notification under Thailand's PDPA where it applies to you.
Compliance alignment
We design our products and deployments to help clients meet their own obligations under:
- India's Digital Personal Data Protection Act 2023 (DPDP) and Information Technology Act, 2000
- Thailand's Personal Data Protection Act B.E. 2562 (PDPA)
- Singapore's Personal Data Protection Act 2012 (PDPA)
- The EU and UK GDPR, for clients with European data subjects
Compliance remains the responsibility of each organisation for the data it controls. We can sign a data processing agreement (DPA) and complete your security questionnaire as part of procurement. Write to office@veliqlab.com.
Responsible disclosure
If you believe you have found a security vulnerability in our website, the CRM or our services, please email office@veliqlab.com with the subject "Security". Include enough detail for us to reproduce the issue. Please give us reasonable time to fix it before any public disclosure, do not access or change data that is not yours, and do not disrupt our services. We appreciate responsible research and will respond as quickly as we can.