Security

How Vespy protects your data.

What the platform actually does today: where your data lives, how it is encrypted, who can reach it, and how AI touches it.

Hosting and backups
- Hosted on AWS in the us-west-2 (Oregon) region
- PostgreSQL on Amazon RDS in private subnets
- Automated backups kept 14 days, with point-in-time recovery
- Deletion protection on the production database
Encryption
- TLS 1.2 or 1.3 for every connection to the app
- Database connections require TLS
- Database storage encrypted at rest
- Documents in S3 encrypted at rest (AES-256), versioned, never public
- Integration tokens additionally encrypted with AES-256-GCM
Sign-in and sessions
- Passwords hashed with Argon2
- Access tokens expire after 15 minutes
- Refresh tokens live in HttpOnly, secure cookies
- Email verification and password reset built in
Access control
- Every query is scoped to your organization on the server
- Six roles: admin, manager, staff, tenant, owner, vendor
- Tenants, owners, and vendors see only their own portal data
- Changes are written to an audit log, with who made them
AI and your data
- AI runs through AWS Bedrock in the same region
- A person approves every AI-proposed lease change
- Agent messages to tenants or vendors always need approval
- Extraction is told not to return SSNs, bank, or card numbers
- AI calls are audit-logged; telemetry records usage, not content
What we do not have yet

Vespy does not offer single sign-on or multi-factor authentication today, and we have not completed a SOC 2 audit. If your firm requires any of these, ask us before you commit.

Questions about security: hello@getvespy.com

AWS publishes how Bedrock handles model inputs and outputs. Read on the date below.

Keep reading

Set up a recovery pool, abstract a lease, and run a reconciliation on the free trial.

14-day free trial · No credit card