V2O Security Overview

At a glance

1. How we protect your data

• Hosting and network. V2O is hosted on AWS in the United States. The database sits on a private network that is not reachable from the internet, and it accepts connections only from the V2O application.
• Encryption. All connections to V2O use HTTPS. Uploaded files, the database, and its backups are encrypted at rest with AES-256.
• Separation between firms. Each firm's data is kept separate by access controls in the application. Users can only open projects that belong to their firm.
• Backups. The database is backed up automatically. Backups are encrypted and retained for 7 days.

2. How V2O uses AI

V2O uses AI for specific tasks within financial workflows: interpreting financial data, classifying accounts, flagging potential anomalies, and assisting with analysis. AI operates within a controlled workflow and does not independently determine final financial outputs. Reviewers see the underlying data and can accept, adjust, or override results. Every figure traces back to the ledger entries and files it came from, so results can be validated rather than taken on trust.

No training on customer data. V2O does not use customer files, engagement data, or outputs to train or fine-tune any model. V2O uses OpenAI and Anthropic, both through their commercial APIs, and under their terms they do not train on data sent through those APIs. They may retain inputs and outputs for up to 30 days to provide the service and detect abuse, and then delete them, except where the law requires longer retention or a policy violation is flagged.

Selective, de-identified inputs. V2O does not send your files or engagements to a provider. For each task it sends only the inputs that task needs, generally in de-identified form: mainly account names, column headers, and a limited set of figures. V2O's analysis does not depend on your client's or the target's name, so names are removed from file names and report title blocks before a request is sent. Data from one engagement or customer is never included in another's AI requests.

Choice of provider. A firm can ask to use a single provider (OpenAI or Anthropic), so that only the provider it picks receives its data.

3. Access to your data

Your users. Your firm decides who has access to V2O, and we set up and remove users at your direction. Users sign in with a secure, single-use link sent to their email address, so access is also protected by whatever MFA and conditional-access policies your firm applies to that mailbox. V2O does not use passwords.

V2O personnel. Access to V2O's production systems and customer data is limited to a single authorized administrator. No other V2O employee or contractor has it. It is used only as needed to support and maintain the service.

4. Retention and deletion

Your data stays in V2O until you delete it. Users can delete a file or a project at any time. Deletion is automatic and permanent, and V2O does not restore deleted items.

After you delete something, temporary copies can remain in two places until they expire automatically:

• V2O's system backups, which we keep for 7 days to recover from a system failure.
• Our AI providers, which may keep the information sent to them for AI tasks for up to 30 days (see Section 2 for exceptions).

At the end of an agreement, we delete your remaining data within 14 days of your request and confirm in writing.

5. Incident response

If a security incident affects customer data, we will notify affected customers without undue delay and within 72 hours of becoming aware of it, share what we know about what happened and what data may be involved, and keep you updated as we learn more.

6. Compliance status and what we offer

V2O is pursuing SOC 2 certification, starting with a Type I report targeted for the first half of 2027 and followed by a Type II report once the observation period is complete. Until then, our controls are documented in this overview, and we will sign your NDA and, if required, a data processing agreement (DPA), complete your vendor security questionnaire, and walk your security team through our architecture.

7. Security roadmap

Planned improvements:

• SOC 2. We are pursuing a Type I report in the first half of 2027, followed by Type II (see Section 6).
• Single sign-on and multi-factor authentication. We plan to add sign-in through your firm's identity provider (such as Microsoft or Google), so your own MFA and access policies apply directly.
• Customer audit logs. We plan to give your firm's administrators a log of who opened, uploaded, deleted, or exported what, and when, that you can review and export.

8. Your responsibilities

Your firm controls who has access to V2O and what is uploaded.

9. Service providers

V2O uses a small number of providers that handle customer data:

Vendors that do not process customer data, such as DNS hosting and source-code hosting, are not listed. A technical appendix with more detail is available on request, under NDA.

10. Contact

For security questions or to start a vendor review, contact V2O AI Inc. at hello@v2o.ai.