Security & data handling
Written for procurement and vendor-risk teams, not for marketing. Every line below is a statement of fact about what the software does today. Where a control is absent, this page says so — an unearned badge costs more than an honest gap.
The short version: GVS Platform, IAS Vault and CAS execute entirely in your browser. Encryption keys are
derived on your device and never transmitted. Your records are stored on your device. GVS operates no
application server and no database in the data path — we host static files. The only outbound network call is
to the model provider when you invoke an AI agent, and it carries the prompt, not your stored records.
// Controls in place today
| Control | Status | Detail |
|---|---|---|
| Encryption at rest | In place | AES-256-GCM via the Web Crypto API, performed on device. Keys derived with PBKDF2 from a user secret; keys are never transmitted or escrowed. |
| Encryption in transit | In place | TLS on every outbound call. Static assets served over HTTPS with HSTS-capable hosting. |
| Authentication | In place | WebAuthn (platform biometric / passkey) for the vault. The Platform gates AI features behind your own Anthropic API key, held only in your browser's local storage. |
| Authorisation | In place | Role-based access control across platform modules. |
| Audit logging | In place | Every assessment records its inputs, generated questions, responses and resulting score — the basis of the glass-box guarantee. |
| Human approval gates | In place | No AI output takes an irreversible action without a human decision. Zero Touch automates repetition, never judgement. |
| Data minimisation | In place | GDPR/DPDP-aligned by architecture: the applications collect no telemetry, set no analytics cookies, and load no third-party scripts or CDNs. |
| Air-gapped / restricted deployment | In place | Single-file applications run from local disk with no network required except the optional AI call. |
| Data export & deletion | In place | Data lives on your device. Export is user-initiated; deletion is clearing your own storage. There is no vendor copy to request the deletion of. |
| Offline operation | In place | Service worker caching — IAS Vault functions with no network connection at all. |
// Not in place — stated honestly
| Control | Status | Position |
|---|---|---|
| SOC 2 Type 1 / Type 2 | Not certified | Type-1 initiation is a funded workstream in the seed plan. We do not display a SOC 2 badge and will not until an auditor issues a report. |
| ISO/IEC 27001 | Not certified | Gap assessment funded in the seed plan. No certificate held today. |
| SSO — SAML / OIDC | Roadmap | On the enterprise tier roadmap. Not available today. |
| Penetration test report | Not yet commissioned | Planned alongside the first enterprise engagement. Source for the client-side applications can be shared for your own review. |
| 24×7 SOC / on-call rota | Not in place | GVS is a small firm. Escalation is founder-direct: acknowledge within 24h, remediation plan within 72h. We would rather state the real SLA than publish one we cannot staff. |
// Compliance framework applicability
Vendor-risk checklists often ask about frameworks that don't fit every architecture. Here's where each one actually stands against what we run:
| Framework | Status | Why |
|---|---|---|
| PCI-DSS | Not applicable | We never process, store, or transmit payment card data in any product. No cardholder data is ever in scope. |
| HIPAA | Not applicable | We do not collect, store, or process protected health information in any product. |
| GDPR / CCPA (CPRA) | Not applicable | All applications set no cookies and hold no server-side personal data, so there is nothing to consent to and no server-side data to request the deletion of — see our Privacy Policy. |
| Third-party vulnerability scans | Not yet commissioned | No recurring automated scan is in place today; see the penetration-test line above. Source is available on request in the meantime. |
// Sub-processors
| Provider | Purpose | Data exposed |
|---|---|---|
| Anthropic (Claude API) | AI agent inference | The prompt you submit at the moment you invoke an agent. No stored records, credentials or vault contents are attached. |
| Static web host | Serving HTML/CSS/JS assets | Standard web request metadata (IP, user agent). No application data transits the host. |
Data residency: for all browser-resident applications your data resides wherever your device is — there is
no GVS region to choose, because there is no GVS store.
// Vulnerability reporting
Found something? Report it to info@gvstechnologies.online. We acknowledge within 24 hours and share a remediation plan within 72. We will credit you unless you ask us not to. Source for the client-side applications is available on request for security review.
Send us your security questionnaire →