Security

Safe, secure, and private.

Everything in Velocity is designed to keep your work safe and secure. Because your business is nobody else's business.

Security practices aligned with industry standards

Enterprise-grade security

Peace of mind-as-a-service. Velocity is built with best-in-class security practices to keep your work safe and secure at every layer. This includes state-of-the-art encryption, safe and reliable infrastructure partners, and independently verified security controls.

Encryption everywhere

All data encrypted in transit (TLS 1.3) and at rest (AES-256). No exceptions.

Access controls

Role-based access control (RBAC). Engineers access only what they need for their pod.

Regular audits

Continuous security monitoring and regular third-party security assessments.

Secure infrastructure

Production environments isolated. Multi-factor authentication required for all access.

AI workflow security

Using AI doesn't mean compromising security. Our zero-trust approach ensures AI tools never access sensitive data through strict data classification and automated controls.

.cursorignore protection

Configuration to block AI access to secrets and sensitive data before any AI-assisted work begins.

Data classification

Three-tier system (Public, Business Logic, Secrets) ensures appropriate handling of all code and data.

Zero-data retention

AI providers configured with privacy mode where available. No training on client code.

Secret scanning

Pre-commit hooks detect and block accidental secret commits before code reaches any AI system.

Human-in-the-loop

Every line of AI-generated code reviewed by senior engineers before merge. No blind acceptance.

Secrets never shared

API keys, passwords, credentials, and PII are blocked from AI tools through automated controls.

Identity management

Keep an eye on your work. And keep other eyes out. Velocity offers multiple layers of access control and authentication to ensure only authorized personnel access your systems.

Senior engineers only

All pod members are vetted senior engineers with proven track records.

Multi-factor authentication

MFA required for all system access. No exceptions, no shared accounts.

Audit logging

All access and changes logged. Complete audit trail for compliance and security reviews.

Least privilege access

Engineers access only resources needed for their specific pod and project.

Privacy

Designed to protect your work. Privacy first, second, and third. Choose what to share and with whom.

Client IP ownership

All code generated belongs to the client. Work-for-hire agreements ensure clear IP ownership.

Transparent data usage

We're explicit about what data (if any) is shared with AI providers and under what policies.

Data minimization

Only necessary data processed. No data retention beyond project requirements.

Privacy by design

Security and privacy considerations built into workflow design, not added later.

Frequently asked questions

How do you prevent AI from accessing our secrets?

We use .cursorignore files to block AI tools from reading sensitive files (.env, credentials, keys, etc.). This is configured before any AI-assisted work begins. Additionally, we use pre-commit hooks to catch any accidental secret exposure.

What data is shared with AI providers like Anthropic or OpenAI?

Only Tier 1 (generic/public) and sanitized Tier 2 (business logic) code. Tier 3 data (secrets, PII, credentials) is never shared. For Tier 2 code, we use models configured with zero-data retention policies where available.

Who owns the code generated by AI?

You do. All work is done under work-for-hire agreements. The code and IP generated during your project belong to you, regardless of whether AI tools were used in the creation process.

How do you ensure code quality when using AI?

Human-in-the-loop review is mandatory. Every line of AI-generated code is reviewed by senior engineers. We use strict linting, type safety enforcement, automated testing, and manual code review before any code is merged.

What happens if a secret is accidentally exposed to AI?

We treat it as compromised immediately. Our incident response includes: rotate all exposed credentials, notify the client transparently, document the incident, and update processes to prevent recurrence. Prevention is always the priority.

Do you have SOC 2 or other compliance certifications?

We are currently working towards formal compliance certifications. In the meantime, we follow security best practices aligned with SOC 2, GDPR, and industry standards. Our processes are designed to meet enterprise security requirements.