Security

How the Veyas app protects your clients' data. The app has not launched; this is how it is built, and what each firm's agreement will commit to before real matters.

Last updated November 1, 2026

veyas.ai, this website

The marketing site, with its design partner sign-up and Contact pages. Hosted on Vercel. It never holds client or case data.

The Veyas app, a separate system

The product law firms and their clients use, in development. Hosted in the United States, with its own privacy policy, terms and data processing agreement.

How client data is protected

Hosted in the United States. Encrypted in transit and at rest.
The most sensitive answers (Social Security number, A-number, passport number, background information, immigration proceedings) are encrypted field by field and are never stored in readable form.
Each firm's records are walled off from every other firm's, down to the database row.
Uploaded documents are encrypted and stored privately under random names, never the original file name, and scanned before anyone opens them.

Who can see a firm's data

Only the attorneys at your firm can view all of its cases. Matters can be limited to the people who handle them.
Clients reach only their own interview, through a private link and a one-time code, and their session is held in a secure cookie.
No one at Veyas has standing access. Support can read a matter only through a time-limited grant your firm admin creates and can revoke, and every read is recorded in an audit log your firm can see.
Logs record what happened, never the answers themselves.

The AI boundary

The most sensitive facts, such as background information and proceedings, are left out of anything sent to the AI, not just hidden.
Identifiers like the A-number are masked before the AI sees them.
The AI reads, checks and flags. It never chooses an answer or approves a matter; the attorney always decides.

How long data is kept

Your firm's data is kept while your account is active, and you can export every matter at any time.
After you cancel, it is permanently deleted within 30 days.
Backups are encrypted the same way as the live data.

Policies and agreements for the app

The App Privacy Policy and App Terms of Service cover the app. Every firm also signs a data processing agreement before using Veyas with real matters; it lists the outside services that handle client data and sets how and when we tell you about a security incident.
A plain-language security summary comes with the agreement.
Veyas has not started a SOC 2 or any other independent audit yet. We will start the process when we are ready, and each report will be listed here as it is issued.

Report a security issue

Found a vulnerability in veyas.ai or the app? Email info@veyas.ai with “Security” in the subject. We reply within 24–48 hours. How this website handles visitor data is in the Privacy Policy; the services both use are on Third-party services.