Built to be trusted with your compliance data.
Vouch handles HR-sensitive content — harassment policies, HIPAA training, signed attestations. Below is what we do to keep that data safe, what we're working on, and how to reach us if you have questions or want to report something.
Compliance certifications
Type I audit scoped for completion within 6 months; Type II observation period to follow. Talk to sales@vouchtraining.io for the audit timeline and the latest gap-analysis summary.
DPA available on request for EU-resident data subjects.
BAA available for healthcare customers handling PHI in policies uploaded to Vouch. Contact sales to sign.
On roadmap after SOC 2 Type II close.
Data residency & hosting
Production workloads run in US-East infrastructure on Railway, with the Postgres primary in US-East and daily off-region encrypted backups. Customer policy documents and learner attestation records never leave the US data plane unless a customer opts into a different region under an enterprise contract.
Encryption
- In transit: TLS 1.2+ enforced on every public endpoint. HSTS preload-eligible.
- At rest: Postgres volume encryption (AES-256), nightly snapshots encrypted with provider-managed keys.
- Secrets:Application secrets stored in Railway's encrypted environment store, rotated quarterly.
- Passwords: bcrypt with cost factor 12; SSO recommended for production deployments.
AI handling
Vouch uses Anthropic Claude to generate course content from your uploaded policies and to grade coverage against legal rule sets. The way customer data interacts with the model:
- No model training on customer data. All Anthropic API calls run under Anthropic's zero-data-retention / no-training enterprise terms.
- Per-tenant isolation. Retrieval indices are scoped per organization — no policy text or course content is shared across customers, ever.
- Source-grounded by default. Strict-mode generation refuses to invent facts not present in your uploaded sources. Citations live in the lesson body.
- Audit trail. Every AI generation is logged with input source IDs, model version, token counts, and cost.
Access control & SSO
- SSO: Azure AD, Okta, and SAML 2.0 supported on Professional and Enterprise tiers.
- RBAC: Five roles (Owner, Admin, Manager, Instructor, Learner) with permission-checked endpoints on every mutation.
- Audit log: Every privileged action recorded with actor, timestamp, IP, and changed fields. Exportable for review.
- SCIM 2.0: Roadmap for Q4 — until then, bulk user provisioning via CSV import.
Subprocessors
Customer data may be processed by the following subprocessors. We give 30 days notice before adding any new subprocessor that handles customer data.
- Anthropic PBC — AI inference (course generation, coverage check). US.
- Railway Corp — application hosting + Postgres. US.
- Stripe Inc — payment processing. US, PCI DSS Level 1.
- Resend — transactional email. US.
- Upstash — managed Redis for job queue. US.
Incident response
We commit to notifying affected customers within 72 hours of confirming a security incident that materially affects their data. Notification includes scope, timeline, root cause when known, and remediation steps. For high-severity issues affecting compliance attestation records we will also notify by phone for customers with that contact on file.
Security contact
Report a vulnerability or ask a security question: security@vouchtraining.io
We respond to all reports within 1 business day. Critical issues acknowledged within 4 hours. We do not have a bug bounty yet — but we are happy to credit researchers in writing.