Which AI provider and model does Vectoris use?
Vectoris uses a single AI gateway operated by our platform partner, Lovable. All AI calls in the application — document extraction, opportunity analysis, workforce signal generation, and market analysis — are routed through that gateway to Google Gemini 2.5 Flash. The application does not call OpenAI, Anthropic, or any other model provider directly, and no third-party AI API keys are configured in the workspace.
Is customer data sent to OpenAI, Anthropic, or other AI vendors?
No. Prompts and uploaded document text are sent only to the Lovable AI Gateway, which routes them to Google for inference on the Gemini model named above. No other AI vendor receives customer data from Vectoris.
Is customer data used to train AI models?
Vectoris does not authorize the use of customer prompts, uploads, or outputs to train any AI model. The application sends data only for inference. The current Data Processing Addendum (DPA) terms of the upstream model provider are being validated as part of pilot-readiness; we will publish provider-specific "no training" language only after that validation is complete. In the interim, we recommend pilot participants treat AI outputs as advisory and continue to avoid submitting Controlled Unclassified Information (CUI), classified material, ITAR / export-controlled data, or sensitive personal data beyond what is strictly required.
Is data encrypted in transit?
Yes. All connections to Vectoris use TLS 1.2+ (HTTPS), enforced by HTTP Strict Transport Security (HSTS) with a one-year max-age and subdomain inclusion. Calls between the application and the AI gateway, the database, and storage are also TLS-protected.
Is data encrypted at rest?
Yes. The managed Postgres database, object storage, and database backups are encrypted at rest by the cloud platform using AES-256. Authentication credentials are hashed (never stored in plaintext) and password reuse is checked against the Have I Been Pwned breached-password corpus before acceptance.
Where is customer data stored, and in what region?
Customer data (accounts, opportunities, reports, workforce profiles, uploaded documents, and derived analyses) is stored in a managed Postgres database and object storage operated by our cloud provider in the United States. Data does not leave the United States as part of normal application operation. AI inference requests are processed by the upstream model provider under its own regional infrastructure.
What is the data retention policy?
Workspace data is retained for the duration of the organization's active pilot or subscription. Audit and security logs are retained for up to 13 months. Administrators may request export or deletion at any time; on written deletion request, or within 30 days of pilot or subscription termination, workspace content is purged from production systems. Encrypted backups age out on the standard rotation (up to 30 days) after which the data is unrecoverable. Full details are in the
Privacy Policy.
What security controls are enabled?
- Row-Level Security (RLS) enforced on every customer-data table; cross-tenant access is blocked at the database layer, not just the application layer.
- Role-based access control: Platform Admin, Organization Admin, User, and Read-Only roles, stored in a dedicated roles table and evaluated by a security-definer function.
- Authenticated server functions guarded by middleware that verifies the user's session token on every call.
- Pilot agreement gate: users must accept the current agreement version before any sensitive server function will execute.
- Have I Been Pwned (HIBP) password breach screening on signup and password change.
- Baseline HTTP security headers on every response: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, and a Permissions-Policy that denies camera, microphone, geolocation, and payment APIs.
- Audit logging of authentication events, agreement acceptance, and administrative actions.
What should customers NOT submit to Vectoris?
Do not upload or paste Controlled Unclassified Information (CUI), classified material, ITAR or export-controlled data, protected health information (PHI), or sensitive personal data beyond what is strictly required to evaluate an opportunity. Vectoris is an advisory tool for non-CUI workforce readiness analysis.
How do I report a security concern?
Contact your organization administrator or CLERCO support. For suspected security issues, please mark the message as "Security" so it is routed appropriately.