Security
How we look after your data and your customers.
Velogics talks to your customers on your behalf, so how it handles their data matters. Here's what's in place today, stated plainly.
Data protection
Sensitive data, protected.
The safeguards between your account, your connected tools and the outside world.
Encrypted at rest
Credentials for your connected accounts, message content and call transcripts are encrypted at rest with AES-256.
Verified webhooks
Webhooks coming in from connected services must carry a valid signature or secret before Velogics acts on them.
Signed, expiring links
Sensitive actions use signed links that expire, like the Owner Agent's one-tap links for sending a quote, an invoice or a message to a customer.
Rate limiting
Requests are rate limited, which slows down abuse and automated attacks.
Access control
The right access for each person.
Each person on your team gets the access they need, and changes leave a record.
Role-based access
Each teammate gets a role, and only owners can change settings, the AI or billing.
Login protection
Repeated failed sign-ins trigger a temporary lockout, and every attempt is rate limited by email address and by IP.
Idle logoff
Accounts that handle health information are signed out after a period of inactivity.
Audit logs
Actions by Velogics staff, including any time we sign in to your account for support, are recorded in an audit log.
Messaging compliance
Texting and email, done properly.
Velogics messages your customers for you, so consent and opt-outs are built into how it works.
Texting consent (TCPA)
Consent to receive texts is captured, and automated texting respects it.
Opt-out replies
STOP and similar replies opt people out automatically, and START opts them back in.
Do-not-contact lists
People on a do-not-contact list aren't sent outreach.
Quiet hours
Automated outreach waits until quiet hours are over.
Email unsubscribe (CASL)
Loyalty and prospecting emails include an unsubscribe link, and unsubscribes are honoured.
AI safeguards
The AI works for you, and you stay in charge.
You can step in on any conversation, and nothing is posted publicly until you choose to.
Human takeover, any time
Reply in any conversation and the AI steps back on it, so you and the AI don't both answer.
You decide what goes public
Review replies are drafts until you post them. Nothing is posted to Google on its own.
Spam, scams and unsafe files
Scam leads flagged. Unsafe files kept closed.
Service businesses get fake jobs too: plans to download and open on a Windows computer, an overpayment cheque, a request for bank details. Velogics watches every conversation for them, and warns you without blocking a real customer.
Possible-scam alerts
A “job” with a file to open on a Windows computer, a file-sharing link, an overpayment cheque, gift cards or a request for bank details gets the lead flagged, and you're alerted by email or text.
A warning before you call back
Call-back tasks for a flagged lead carry a warning. Nothing is blocked on a guess: you mark the lead as spam, or clear it as not a scam.
The AI doesn't open links or documents
The AI never opens a link or a document a customer sends. The only attachments it reads are photos of the job.
Photos only in your website chat
Your chat takes JPEG, PNG, GIF and WebP photos up to 4 MB, checked from the file itself rather than its name. Anything else is turned away.
Other files never open in the app
Files emailed or texted to you are kept in private storage. Only photos show in the inbox; anything else downloads only when a signed-in teammate chooses to.
Junk email set aside
With the AI Email Assistant, spam, phishing and sales pitches are set aside instead of answered.
Hosting and sub-processors
Where your data lives.
Velogics data is hosted in the United States, on Vercel and Neon. Every company that processes data for us is listed on our sub-processors page.
Built on
- Vercel · Hosting
- Neon · Database
- Twilio · Phone and texting
- ElevenLabs · AI voice
- Anthropic · AI models
- Postmark · Email
- Stripe · Billing
Current status
What we don't claim yet
Velogics does not have a SOC 2 report today, and we don't claim HIPAA compliance. Our data is hosted in the United States, not in Canada. Signing in is by email and password, with no second step such as a code from an app, and no option to sign in with a Google or Microsoft account. If your business needs any of these, talk to us before you commit, and we'll tell you where things stand.
Contact
Security questions
Have a question about how Velogics handles data, or need details for a vendor review? Email us and we'll get back to you.
sales@velogics.aiOther ways to reach usFAQ
Common questions
Can I use Velogics with health information?
Talk to us before you do. We don't claim HIPAA or PHIPA compliance today.
Is there a data processing agreement?
Yes. Our standard Data Processing Agreement is part of our Terms of Service and applies whenever Velogics processes your customers' personal data on your behalf.
Can Velogics stop my team from opening a dangerous file?
It keeps files from opening by accident: anything other than a photo never opens inside Velogics, and a lead pushing you to open a file is flagged as a possible scam. A teammate can still download a file on purpose, so treat unexpected attachments with care.
What happens to my data if I leave?
Your data stays in your account, so you can pick up where you left off if you come back. Ask us at any time to export it or to delete your account, and we'll complete the request within 30 days. Records the law requires us to keep, such as billing records, are kept.
See how Velogics works, safely.
Book a demo and we'll show you the controls on a live call, from human takeover to review replies.