Everything a security review asks for, in one place.
Veil handles the most sensitive material an organisation holds, on behalf of a request it is legally obliged to answer. This page is where the documents, the posture and the honest status of our certifications live.
Public, current, and no request needed.
Every document below is published in full. None of it is behind a form.
- v1.0
Terms of service
The agreement between your organisation and us for the use of Pritect Veil. Self-serve, no order form required, and terminable at any time.
Effective 22 Aug 2026 - v1.0
Privacy notice
How we handle personal data when you visit this site, create an account or contact us. Documents you upload into a case are covered by the Data processing agreement instead, because for those we are not the controller.
Effective 22 Aug 2026 - v1.0
Data processing agreement
The Article 28 terms under which we process personal data on your instructions, including the description of processing and the security measures we commit to.
Effective 22 Aug 2026 - v1.0
Sub-processor list
Every third party that processes personal data on our behalf when we provide Pritect Veil, what it does, and where it runs.
Effective 22 Aug 2026 - v1.0
Acceptable use policy
What Pritect Veil may and may not be used for. It exists because a redaction tool sits close to material that would do real harm in the wrong hands.
Effective 22 Aug 2026 - v1.0
Cookie notice
What we store in your browser on veil.pritect.ai, why, and how to change your mind. The short version: what we set is what the service cannot run without.
Effective 22 Aug 2026 - v1.0
Third-party licences
The open source software Pritect Veil is built on, and the licences it is used under.
Effective 22 Aug 2026 - Overview
Security architecture
How residency, encryption, retention, access, logging and product integrity actually work, written for the person who has to sign off on it.
Always current
What we hold ourselves to.
Six commitments that decide how the product is built, each of them visible somewhere in the documents above.
Privacy by construction
Uncertainty resolves to redaction, personal data never enters a log, and a purge destroys the key rather than only the rows.
Security
Tenant isolation enforced by the database, short-lived single-object storage access, encryption in transit and at rest, and envelope encryption on the densest personal data.
European residency
Database, storage, workers, web functions and model inference all inside the European Union, pinned rather than defaulted.
Verifiable output
A verifier that shares no code with the redaction pipeline re-reads every generated document and can withhold it.
Responsible automation
European model inference, stateless calls, no training on customer data, and human review of every flagged entity.
Accountability
An append-only audit log covering transitions, decisions, downloads and configuration changes, exportable by the customer.
Where we actually are.
Certification status, stated plainly. Nothing on this list is implied, and nothing is described as achieved before it is.
- Self-declared
GDPR
EU General Data Protection Regulation
- In progress, target 2027
ISO/IEC 27001
Information security management system
- On the roadmap
SOC 2 Type II
Security, availability and confidentiality controls
- On the roadmap
ISO/IEC 27701
Privacy information management system
We would rather tell you where we actually are than imply a certificate we do not hold. Pritect Veil is a new product inside an established group, and the certification work runs at the group level. This page changes when the status changes, not before.
What a security review usually asks.
Are you a controller or a processor?
Both, for different data. We are the controller for your account, our correspondence with you and our billing records, which the Privacy notice covers. We are your processor for everything inside the documents you upload, which the Data processing agreement covers. The split matters, so it is the first section of the Privacy notice.
Can we audit you?
Yes. Clause 4 of the Data processing agreement gives you an audit right on thirty days' notice, once a year, extended if a supervisory authority requires it or a breach has occurred. We also answer a security questionnaire annually and publish the security measures we commit to as Annex 2.
Where does the data go?
Nowhere outside the European Union in the ordinary course. Database and object storage in Frankfurt, processing workers in Frankfurt and Amsterdam, web functions pinned to Frankfurt, model inference at a European provider. The Sub-processor list names every party and where it runs.
Do you train models on our documents?
No, and we do not permit our sub-processors to. Model calls are stateless: the text goes out, the structured result comes back, nothing is retained. That is a contractual commitment in clause 5.3 of the Terms of service, not only a setting.
What happens if a redaction is missed?
The verifier is designed to catch it before release, and a verifier hit blocks the case rather than warning about it. If a hit relates to a bundle already released, we treat it as a suspected personal data breach and notify you under clause 6.4 of the Data processing agreement.
How do we get the documents for our vendor file?
Everything below is public and needs no request. For a signed data processing agreement, a completed security questionnaire or a sub-processor notification subscription, write to the address on this page.
Ask a person.
Security questionnaires, a signed data processing agreement, sub-processor notifications, or anything this page does not answer.
Security and abuse
security@pritect.aiPrivacy and data rights
privacy@pritect.aiContracts and legal
legal@pritect.aiWhite Label Consultancy AS, Fjordalleen 16, 0250 Oslo, Norway. Reported security issues are acknowledged within two business days.
Your next access request does not have to eat a week.
Open a case, declare the subject, drop the documents in. Veil does the rest and shows you its working.