Security at Viti

All application data is hosted on Microsoft Azure in Sweden Central, and model inference runs exclusively through EU-processing routes. First-party endpoints that process outside the EU are excluded from the catalogue by validation, in code.

Personal data is detected and replaced with reversible placeholders before any request leaves our infrastructure for a model provider, and restored on the way back. The placeholder vault lives only in memory for the duration of a single request and is never persisted. If the privacy service is unavailable, affected requests are rejected rather than sent onward unprotected.

Every tenant's data is separated by row-level security in PostgreSQL, enforced by the database itself rather than by application code alone. Uploaded files live in private storage under tenant-prefixed keys.

All traffic is encrypted in transit with TLS — between you and Viti, and between Viti and every provider. Data at rest is encrypted by the underlying Azure services.

Provider API keys and other secrets are stored in Azure Key Vault and referenced at runtime. They are never committed to source code or configuration files.

Found a vulnerability? Write to security@viti.fo. We acknowledge reports within two business days and will not take legal action against good-faith research.

Viti does not currently hold ISO 27001 or SOC 2 certification, and we will not imply otherwise. What we publish here is what is actually built and enforced.