Security is structural
Isolation you can point to, not policy you have to trust
Private markets run on confidential information. Vega is built so that confidentiality is a property of the architecture: each customer runs on their own isolated stack, we do not use customer data to train models, and we are SOC 2 Type II compliant.
Independently examined
Visit the trust centerSOC 2 Type II
SOC 2 Type II compliant, covering all five trust service categories.
Examined in practice
A Type II report examines how our controls operate in practice over time, not only how they are designed.
AI that answers to people
We do not use customer data to train models.
Independently tested
We commission independent penetration testing of our AI interfaces, including our MCP server.
More than one check
Automated security analysis runs across our system through more than one independent mechanism, so no single tool is the sole check.
A second person
Wire instruction and contact matrix changes each require approval by a second individual, who cannot be the person who submitted them.
One customer, one stack
Today, every customer runs on their own isolated stack: a dedicated database, dedicated encryption keys, dedicated queues and storage. Your data is not a row in a shared table behind a filter. Isolation is structural, so the boundary between customers is enforced by the architecture itself, not by query logic.
Encrypted throughout
At rest
Customer data is encrypted at rest across our production platform.
In transit
TLS 1.3 is in use on our production hosts, and HSTS is enforced.
Field by field
Sensitive data fields can be encrypted individually, in addition to encryption at rest.
Keys kept apart
Encryption keys are held in a separate managed key service, not alongside the data.
Key exchange
Our public TLS endpoints offer hybrid post-quantum key exchange to supporting clients.
Access is earned and reviewed
Role-based access
We operate role-based access control on our production systems.
Reviewed quarterly
We review access to our systems quarterly and track changes to completion.
Multi-factor authentication
We require multi-factor authentication for our staff accessing production systems.
One identity provider
We centralise identity on a single corporate identity provider.
Credentials
Credentials are held in stores with role-based access and audit logging: an enterprise password manager for human-held credentials, cloud-managed secret storage for production.
Ready, and accountable to you
A documented plan
We maintain a documented incident response plan and classify incidents against defined severity criteria.
Clear ownership
Ownership and escalation routes are defined for each severity.
Notification
We treat notification obligations to our customers and to our regulator as part of the response, on the timelines they require.
The whole company
An incident affecting our customers takes precedence over planned work, and we resource it across the company rather than leaving it with the security team.
Kept informed
We keep affected customers informed while an incident is live, not only once it is closed.
Found before it matters
Continuous scanning
We run continuous automated scanning of first-party code and third-party dependencies across all our repositories.
Independent testing
We commission independent external penetration testing.
Prioritised by exposure
We assess reachability and real-world exploitability to drive remediation priority.
Escalated when it counts
Security findings that meet incident criteria are routed to the incident response plan rather than handled as routine remediation.
Your data, where you need it
Your jurisdiction
Residency is available in different jurisdictions, depending on customer requirements.
Retention and disposal
We operate documented retention and disposal procedures covering customer data.
Regulated records
Records relating to our regulated business are retained in line with our regulatory obligations, including GDPR.
Privacy notice
We publish a privacy notice and keep it current.
Questions we are asked
Do you train AI models on our data?
No. We do not use customer data to train models.
Is Vega SOC 2 compliant?
Yes. Vega is SOC 2 Type II compliant, covering all five trust service categories.
Do you commission penetration testing?
Yes. We commission independent external penetration testing, and independent penetration testing of our AI interfaces, including our MCP server.
Where is our data stored?
Residency is available in different jurisdictions, depending on customer requirements.
Is our data encrypted?
Yes. Customer data is encrypted at rest across our production platform, TLS 1.3 is in use on our production hosts, and encryption keys are held in a separate managed key service. Sensitive data fields can also be encrypted individually.
How would we hear about a security incident?
We treat notification obligations to our customers and to our regulator as part of our incident response, on the timelines they require, and we keep affected customers informed while an incident is live.
See it for yourself
Walk through the platform with us, and bring your security team.
SOC 2 Type II report
Covering all five trust service categories