Security
Your data security is our top priority. Learn how we protect your information.
Security Overview
VAKE AI is built with enterprise-grade security from the ground up. We implement industry best practices to ensure your data remains protected at all times.
Data Protection
Encryption
All data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher.
Credential Security
Your SuccessFactors API credentials are encrypted with AES-256 before storage. We never store them in plain text.
What We Store
We do not keep a copy of your SuccessFactors database; data is read live when you ask. Chat history and generated files can contain employee data and are stored in the EU until deleted (workbook history for up to 365 days).
Access Control
Authentication
Sign-in uses Firebase Authentication with email and password, and sessions end after 30 minutes of inactivity by default. Two-factor authentication and single sign-on are not available; Microsoft Entra ID single sign-on is planned.
Role-Based Access
Users are assigned roles (Company Admin, HR Admin, Manager, Employee or Support) with different permissions. Access to SuccessFactors data is also limited by the permissions of your SuccessFactors API user.
Audit Trail
An audit log records chat and Config Aide requests (including which SAP tools were used), settings changes and configuration transfers. Your administrators can review and export it.
Infrastructure Security
Cloud Platform
Hosted on Google Cloud (Firebase App Hosting and Cloud Run in europe-west4, Netherlands). Google Cloud holds ISO 27001 certification and SOC 2 reports; VAKE holds no certification of its own.
Tenant Isolation
Each organization's data is kept under its own tenant ID in a shared database, and requests are checked against the signed-in user's tenant.
Backup & Recovery
Automated daily backups with point-in-time recovery capabilities.
Compliance
GDPR
GDPR tools: self-service data export and account deletion, data subject request tracking, a processing record (Article 30) report and audit logs. A Data Processing Agreement is available on request.
Certifications
VAKE holds no ISO 27001, SOC 2 or PCI DSS certification of its own. Our hosting and payment providers (Google Cloud and Stripe) hold their own certifications and audit reports.
Data Location
Our database is in Google Cloud's eur3 multi-region (Belgium and the Netherlands, witness in Finland), and file storage and hosting are in europe-west4 (Netherlands). Firebase Authentication processes sign-in account data (email, password hash, IP addresses) in the United States, and our AI providers (Anthropic, xAI, OpenAI) process AI requests in the United States or globally.
Vulnerability Disclosure
Found a security issue? We appreciate responsible disclosure.
Contact our security team at security@vakeconsulting.com