Trust & deployment readiness
Pilot readiness and production readiness are assessed separately
Venora is designed to support customers' GDPR, EU AI Act and sector-specific governance obligations. Compliance depends on each organisation's role, intended use, configuration, contracts and internal processes.
What Venora does
Venora connects exclusively to approved internal knowledge sources and helps authorised employees obtain clear answers backed by citations to the original evidence. Customer-defined access controls strictly limit what each user can retrieve. When sufficient evidence is not available, the assistant states this explicitly rather than generating unsupported content.
How to read this page
What exists today, and what must pass before production.
Venora does not process production customer data until the applicable security, privacy and governance controls for that deployment have been implemented, tested and accepted.
- Pilot ready
- Usable in a limited, agreed pilot today, on the scope and sources defined with you.
- Where supported
- Implemented, and applicable depending on the deployment and the connected source systems.
- Required before production
- Part of the production security baseline. Must be implemented, tested and accepted before customer production data is enabled.
- Confirmed per engagement
- Depends on your environment, risk profile and deployment model, and is agreed in writing.
Where a control is implemented but not independently tested, we say implemented, not certified. We do not claim that a control has passed a review that has not taken place.
Experience Venora, the interactive demonstration on the homepage, is a public demonstration environment running on fictional approved documents. It illustrates product behaviour; it is not the production Venora security and permission architecture described on this page.
Pilot readiness
What can be used in an agreed pilot today.
A pilot runs on a contained set of approved sources and a named group of users, with the scope, data and duration agreed in writing before it starts.
- Evidence-linked answersPilot ready
- Material answers resolve to the specific document, section, version and approval status supporting them.
- Human reviewPilot ready
- Answers are advisory. The person acting on an answer remains accountable, and conflicting sources are escalated for review rather than resolved silently.
- Customer-scoped knowledgePilot ready
- Your organisation defines which approved sources exist in the pilot and which groups of users may reach them.
- Insufficient-evidence behaviourPilot ready
- Venora is designed to state that the authorised sources do not support an answer rather than compose one.
- Permission-aware retrievalWhere supported
- Entitlements are evaluated before retrieved content is supplied to the model, where the connected source system supports it.
- Dedicated European deploymentWhere supported
- An isolated pilot environment operated within agreed European infrastructure.
Production security baseline
Release requirements, not marketing features.
These controls are a condition of production release. Pilot and production readiness are assessed separately, and production deployments require the applicable security baseline to pass before customer data is enabled.
- Encryption in transit and at rest
- Encrypted transport and encrypted storage across the deployment.
- Tenant isolation
- Separation of customer data, indexes and derived artefacts.
- Identity and access control
- Authenticated access, least-privilege administration and enforced entitlements.
- Auditability
- Recorded queries, retrievals and administrative actions available for customer review.
- Retention and deletion
- Defined retention windows, deletion on request, and removal of withdrawn sources from the retrievable index.
- Secrets management
- Managed handling and rotation of credentials and keys.
- Backup and restoration
- Backups with a tested restoration procedure.
- Incident response
- Documented procedure for detection, containment, customer notification and follow-up.
- Vulnerability management
- Dependency and platform monitoring with a defined remediation process.
- Independent penetration testing
- Third-party testing of the deployed environment before production data is enabled.
- Release controls
- Change management, review and controlled deployment of product releases.
Required before production
Required before production
Required before production
Required before production
Required before production
Required before production
Required before production
Required before production
Required before production
Required before production
Required before production
The applicable baseline for your deployment, the evidence we will provide for each item and the acceptance point are agreed with you in writing before any production data is enabled.
Deployment-specific controls
Controls that depend on your environment.
These are not universal claims. Each is scoped, priced and confirmed for the individual engagement.
- Customer-managed keysConfirmed per engagement
- Encryption keys held and controlled by the customer.
- Private cloudConfirmed per engagement
- Deployment inside your own cloud tenancy under your existing identity, network and monitoring controls.
- Self-hostingConfirmed per engagement
- Deployment on customer-controlled infrastructure.
- Enhanced access controlConfirmed per engagement
- Additional restrictions such as network boundaries, stricter source scoping or named-user limitation.
- Sector-specific controlsConfirmed per engagement
- Controls required by a specific regulatory or quality framework in your organisation.
Roadmap
Direction, stated as direction.
Future capability, listed so that you can judge where the product is going. Not available today, and never presented as available.
- Permission synchronisation with source systems
- Automatic mirroring of entitlements held in connected document stores.
- Customer-facing governance console
- Self-service visibility of sources, scopes and usage for your administrators.
- Additional connectors for controlled document systems
- Broader coverage of quality, contract and technical document repositories.
Roadmap
Roadmap
Roadmap
Documentation
Documentation for a proposed engagement.
Qualified organisations can discuss the documentation required to assess a proposed evaluation or deployment. Availability depends on the engagement stage and the deployment being considered.
- Product and architecture overviewConfirmed per engagement
- Data-flow descriptionConfirmed per engagement
- Security-control overviewConfirmed per engagement
- Deployment requirementsConfirmed per engagement
- Data-processing termsConfirmed per engagement
- Subprocessor informationConfirmed per engagement
- Evaluation scope and success criteriaConfirmed per engagement
- Production-readiness requirementsConfirmed per engagement
Our position
We do not sell compliance.
Deploying an AI assistant does not make an organisation compliant. We provide technical controls, evidence trails and documentation so that your compliance, quality and security functions can assess the system against their own frameworks. We support that assessment directly.
Compliance depends on each organisation's role, intended use, configuration, contracts and internal processes. We distinguish between a designed requirement, an implemented control, an available deployment option and an independently tested control, and we will tell you which applies to any item on this page.
To report a suspected vulnerability, see our security contact.