Security
Your AI assistants never receive your passwords.
Your keys stay in a vault on our control plane. The assistants ask; the control plane checks, uses the key, and returns the result. Below are 14 claims about how that works — each with the file in our code that makes it true, written for whoever has to sign off.
One tool call, start to finish
Thinks. Holds no keys.
- Executes nothing locally
- Never learns which organisation it serves
- Carries only its own sign-in key
→ a request, never a secret
Holds the keys. Checks every call.
- Secrets in AWS SSM Parameter Store
- Resolves the organisation, re-checks permission
- One auth path, every call
→ the key, used here only
CRM, calendar, inbox, books.
- Called by the control plane
- With your key, on your behalf
- The result goes back — the key doesn't
One tool call, start to finish. The assistant sends a request, never a secret. Sources: veloxp-agent/README.md · packages/dashboard/src/server/tenantProvisioner.ts
How to read this page
A claim without a file reference doesn't ship.
Each statement names its path in the VeloXP platform repository. On 5 Oct 2026 we opened every one of those files and checked that the code still does what the sentence says. Claims that didn't hold up aren't softened — they're left off.
01 · Sealed
The assistants never hold your keys.
Your passwords, API keys and the access keys your connected apps issue live in a vault on our control plane. An assistant asks for an action; the control plane checks it, uses the key, and hands back the result. The key never travels to the assistant.
- 01
The assistant runtime executes nothing locally and holds no credentials. Every tool call goes to one gateway, carrying only that assistant's own sign-in key; the control plane resolves the organisation and the credentials. The runtime never learns which organisation it is working for.
Source: veloxp-agent/README.md (Invariants) · veloxp-agent/docs/DESIGN.md D4
- 02
Integration secrets — AI provider keys, access keys for your connected apps — are deliberately never synced into the assistant's pod. The only secret that reaches it is that assistant's own sign-in key; everything else is fetched server-side at tool-call time.
Source: packages/dashboard/src/server/tenantProvisioner.ts:584–591
- 03
Secrets are stored in AWS SSM Parameter Store and projected per tenant by External Secrets Operator.
Source: infra/eks-prod/eso.tf
- 04
The code that calls AI providers refuses vendor account surfaces — API-key management, billing, team and admin endpoints at Anthropic, OpenAI and Bedrock — and fails loudly instead of reaching them with the platform's key.
Source: veloxp-agent/src/llm/denyPolicy.ts · checked in src/llm/providerClient.ts
02 · Independent
Not tied to one AI company.
No AI company owns us, so no company's AI model is the default for every job. Each playbook can carry the AI model that did it best, across five AI providers — including our own self-hosted models.
- 01
Per-playbook AI model choice: starting a playbook that names a preferred AI model switches to that model for the playbook's work, and finishing the playbook switches back.
Source: veloxp-agent/src/model/stack.ts
- 02
When a playbook has been tested across AI models, the winner writes that reply — and the reply records which model was chosen and why.
Source: veloxp-agent/src/model/selection.ts
- 03
Five AI providers: Anthropic, OpenAI and AWS Bedrock directly, OpenRouter, and our own self-hosted models, which we run on vLLM. Those self-hosted models are VeloXP's own, not a self-hosting option for customers.
Source: veloxp-agent/src/llm/providers.ts · src/llm/failover.ts · infra/k8s/templates/vllm-batch.yaml.tmpl
- 04
A request for our self-hosted models is never quietly rerouted to someone else's model. If they aren't configured, it fails loudly and leaves an audit row.
Source: veloxp-agent/src/llm/providerClient.ts (SELF_HOSTED_NOT_CONFIGURED)
03 · Checked
Work is checked before it leaves.
Assistants work inside written rules, outward-facing work waits for a person, and the playbooks they follow were read line by line.
- 01
Every finished reply is judged against the Laws of Robotics and the rules of the playbook the assistant is following before it is returned; on "revise" the assistant fixes it with its tools. The check is on by default. If the judge itself is unavailable, the reply goes through and the audit record says so — it fails open, on purpose, and visibly.
Source: veloxp-agent/src/agent/evaluator.ts · src/config.ts (EVALUATOR_MODE, default on) · LAWS_OF_ROBOTICS.json
- 02
Workflows carry approval gates and deliverables carry an approve step, as named actions in the platform's tool surface.
Source: packages/dashboard/src/server/dashboardSurface.json (workflows.approve-gate, deliverables.approve)
- 03
The whole playbook library was security-scanned on 11 July 2026: 95 units, every playbook file (SKILL.md) and code file read in full, no malware, no credential harvesting, and no finance or payment playbook with a path around its human-approval gate. The scan is now a standing procedure, mandatory before any third-party playbook is imported.
Source: audits/skills-security-scan-2026-07.md · skills/governance/skill-security-scan/SKILL.md
- 04
Playbooks taken from outside sources carry a provenance record — sixteen PROVENANCE.md files today.
Source: skills/**/PROVENANCE.md
04 · Stateless
Kill the pod, lose nothing.
Assistants keep no local state. If one is stopped mid-task, nothing it knew is lost and nothing is left lying around on a disk.
- 01
The assistant runtime is ephemeral: no session store, no working-folder accretion, no local state of any kind. History is replayed by the control plane on every request; durable data goes through organisation tools.
Source: veloxp-agent/README.md (Invariants)
- 02
One active run per conversation; a newer request supersedes the old one, and every run is wired to a wall-clock timeout and graceful shutdown.
Source: veloxp-agent/src/run/supervisor.ts
Paths are in the VeloXP platform repository. Re-read against the code on 5 Oct 2026.
What we don't claim
Where we stop short — on purpose.
- No uptime or SLA numbers. We'll publish them when real telemetry backs them, not before.
- The July 2026 playbook scan covered the library as it stood then. Playbooks added since fall under the import procedure; a full re-scan is pending.
Related policies and contacts
Your data
What we collect, how connected services and AI providers handle it, and your rights.
Privacy policy →Recorded calls
When we run a workflow with you, on a call or in a hand-run, we record only with your consent, and we ask before we start.
Ask about a recording →Security questions
Questionnaire, architecture walk-through, or a question this page doesn't answer — ask a person.
max@veloxp.com →See it on your own business.
Start with the free AI Strategy Builder: about seven minutes, no card, an AI strategy you keep. When your workflows run, you approve everything before it sends. A human texts or emails you back, 8am–8pm PT.