Data sovereignty is the feature, not the disclaimer.
Institutions do not buy a promise. Every claim below is paired with the technical control that enforces it — and where something is still in progress, we say so.
Tenant isolation, enforced twice
A host-only session cookie plus a middleware check that the session’s organisation matches the subdomain it arrived on. Then, independently, PostgreSQL row-level security keyed on the organisation id — set per transaction, so a query that forgets its filter still cannot read another institution’s rows.
A cross-tenant read fails the build. Two organisations are seeded in CI and every read, write, insert and unbound query is asserted against.
No learner PII reaches a model
Pseudonymisation happens before the AI gateway, not after. Learners are referenced by a stable pseudonym in every prompt, embedding and log. Case content passes a de-identification gate or it does not get created.
Zero-data-retention terms with our model provider — tenant data is never used for training.
AI drafts, humans sign
Models draft items, tag content and explain misses. No model publishes an item, rates a milestone or issues a CME credit. Those actions require a human identity, and the audit log records which one.
A milestone rating without a human rater id is rejected at the database, not by convention.
An audit log that cannot be rewritten
Every consequential action is recorded with actor, resource, before and after. The table is append-only: updates and deletes are blocked by database triggers, not by application code that a future change could bypass.
One sanctioned purge path exists for the retention policy, and it must be opted into explicitly.
Access needs a relationship or a grant
Educators see the cohorts they teach. Program directors see their own programs. An institution admin does not get item-level learner performance by virtue of being an admin — that requires an explicit, time-boxed purpose grant, and the grant itself is logged.
Modelled on the FERPA legitimate-interest boundary rather than a flat role hierarchy.
Transport, storage and secrets
TLS 1.2+ in transit and encryption at rest. Passwords are bcrypt with a per-user salt. Sessions are revocable server-side — signing out kills the session immediately rather than waiting for a token to expire.
Secrets live in the platform key store and never in the repository.
Compliance posture, stated plainly
SOC 2 Type II evidence collection begins with the pilot phase. We would rather tell you that than imply a certificate we do not yet hold.
Two deployment modes, one codebase
Self-hosting is a first-class path, not a bespoke fork. The sovereign module is the same application, deployed by Terraform into infrastructure you own.
Velo Cloud
Most institutions
- Multi-tenant, one subdomain per institution
- Row-level security isolates every tenant in the database
- Per-tenant storage prefixes and branding
- We run upgrades, backups and monitoring
Sovereign
When data must not leave your walls
- Deployed into your own Azure tenant via Terraform
- Single tenant, physically isolated — not just logically
- Your key vault, your network boundary, your retention
- Same codebase, so features do not lag behind the cloud
Running a security review?
We will walk your IT and compliance teams through the isolation model, the data flows, and the sovereign deployment — with your questionnaire in hand.