# Security and your data · VANDAM > How VANDAM handles client data: work in your own accounts, named access removed at handover, no training on your data, agents that ask before they act, a DPA on request. And the security services we sell. URL: https://vandam.ai/security Contact: hendrik@vibelab.be # Security and your data. We work inside your systems with your data, so how we handle both is written down before we start. These are the rules we keep on every project, and the security work we do for companies that need it. ### First day - Named accounts in your tenant, one per person and one per agent - Scopes set to the task, read-only by default - No shared logins, no admin rights unless a task needs them ### Every day - Every agent action logged in your systems, where you can read it - Sends, posts, payments and deletions wait for a person - Access widens only with your IT lead’s agreement ### Handover - Logs, code and documentation handed over - Our accounts and keys removed, from a list we send you - Project data deleted from our machines, confirmed in writing ## The work happens in your accounts Wherever we can, we build and run things in your own tenant: your Microsoft 365 or Google Workspace, your cloud account, your code repository, your AI business plan. Your data stays where it already lives, under your own admin, your own retention rules and your own audit log. When something has to run outside your accounts, for example a prototype before your IT team has set up a place for it, we say so in the proposal, name the service it runs on and move it into your accounts before handover. ## Named access, removed at handover Each person on the project gets their own named account from your IT team. No shared logins and no admin accounts unless a task needs one, and then only for that task. Access starts read-only and widens only when a step needs it, with your IT lead’s agreement. Agents get their own identities too, with scoped tokens, so they show up in your access reviews like any other user and can be switched off without touching a person’s account. At handover your IT team removes our accounts and revokes the keys we used. We send the list of everything we were given, so nothing is forgotten. ## Agents ask before they act The agents we build do not send email, post in public, pay, delete records or change permissions on their own. They prepare the action and a person approves it. You can remove that step for a specific action later, in writing, once you have seen the agent do the work well. That is your decision, never a default. Every action an agent takes is logged: what it read, which tools it called and what it changed. The logs stay in your systems and are handed over with the rest of the work, so you can reconstruct any decision months later. Renewals agent Waiting for approval Send a renewal reminder to **214 customers** - **From** renewals@ your domain - **Data** CRM, read only - **Can undo** No Log, kept in your systems 1. 09:12 Read the view “Renewals due” in the CRM, 214 rows 2. 09:13 Drafted 214 emails from the renewal template 3. 09:13 Waiting for approval from the customer success lead ## Your data does not train anyone’s model We only send client data to AI models through business plans or the API, never through a personal account or a consumer plan. Those are the plans where the providers do not train on your inputs by default. Anthropic states that “by default, we will not use your inputs or outputs from our commercial products” to train its models ([Anthropic privacy center](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training)). Where you already pay for a plan, we use yours. We do not use what we see in your company to train models, write case studies or build products for anyone else. A case study only happens with your written approval, and without your name unless you ask for it. Your company’s data Business plan or API Not used to train the provider’s models by default How we work Personal or consumer account Training settings depend on the person’s account Never for client work ## Secrets, copies and deletion - **Keys and passwords** Kept in your secret store or password manager. Never in code, prompts, documents or chat messages, and never in a repository, even a private one. - **Copies of data** We work on the live system through scoped access, or on a sample you choose. We do not take full exports unless the task needs one and you agree. - **Our machines** Encrypted laptops with a password manager and two-factor sign-in on every account that touches client work. - **At the end** Project data is deleted from our machines and accounts at handover, and we confirm it in writing. We keep the contract and invoices, and nothing else, unless you ask us to. ## Contracts and sub-processors When we process personal data for you, we sign a data processing agreement as required by [GDPR Article 28](https://gdpr-info.eu/art-28-gdpr/), on your template or ours. It lists the security measures we take under [Article 32](https://gdpr-info.eu/art-32-gdpr/) and the sub-processors below, and we tell you before we add one. We use a provider only when you choose it for your project: pick your stack to see who would see your data. - **Anthropic** Claude models, through the API or a Claude business plan. - **OpenAI** ChatGPT and OpenAI models, through the API or a ChatGPT business plan. - **Google** Gemini models and Google Workspace, through Google Cloud or a Workspace business plan. - **Microsoft** Copilot, Azure OpenAI and Microsoft 365, through your own tenant. - **Vercel** Hosting for apps and tools we build, when you choose not to host them yourself. Our own privacy notice is on [the privacy page](https://vandam.ai/privacy), and the terms we work under are on [the terms page](https://vandam.ai/terms). ## No certificate, and what we do instead SOC 2 and ISO 27001 are built for companies that run a service for many customers on their own infrastructure. We are a small studio working inside yours, so the controls that matter are yours, and our job is to work within them. If your vendor review needs something we have not listed, ask and we will tell you plainly whether we can do it. ### What we do not hold - A SOC 2 report - An ISO 27001 certificate ### What we do instead - We fill in your security questionnaire - We sign your DPA and confidentiality terms - We follow your IT policies and access reviews - The commitments on this page go into our contract ## Report a problem If you think something we built or run has a security problem, or you found a weakness on this site, email [hendrik@vibelab.be](mailto:hendrik@vibelab.be?subject=Security) with “Security” in the subject. Hendrik reads it himself and you get an answer within one working day. If you research a weakness in good faith, we will not take legal action against you. Only access what you need to show the problem, do not change or delete data, give us reasonable time to fix it before you publish, and do not test systems that belong to our clients without their permission. We will tell you when it is fixed and, if you want, credit you. [/.well-known/security.txt](https://vandam.ai/.well-known/security.txt) Contact: mailto:hendrik@vibelab.be Contact: https://vandam.ai/contact Expires: 2027-11-06T00:00:00.000Z Preferred-Languages: en, nl Canonical: https://vandam.ai/.well-known/security.txt Policy: https://vandam.ai/security ## Security work we do for you. Staff now build their own tools with AI and connect agents to company systems, and most companies have no list of either. These four services find what exists, test it the way an attacker would, fix what gets through and write it all down. The background is in the note [The apps your staff built last month](https://vandam.ai/notes/the-apps-your-staff-built). 01 Find ### [Internal Apps Sweep](https://vandam.ai/internal-apps-sweep) Find, test and fix the apps your staff built with AI. **$8,000** two weeks, up to 25 apps 02 Test the apps ### [Adversarial App Audit](https://vandam.ai/adversarial-app-audit) Verified security findings with code fixes. **$9,600** one week · one app, up to 40 endpoints 03 Test the agents ### [Agent Attack Audit](https://vandam.ai/agent-attack-audit) Red-team your agents and their connections. **$8,000** two weeks · one agent, up to 10 tools and connections 04 Write it down ### [AI Act Deployer File](https://vandam.ai/ai-act-deployer-file) Every AI system you use, classified and documented in one file. **$8,000** three weeks [**The AI Act, for companies that use AI.** Tick what you use and see which duties apply, and from when.](https://vandam.ai/ai-act)