Skip to content

Compliance

This page describes Venturi’s compliance controls, diligence artifacts, and external attestation status.

How to read this page

This section describes Venturi’s security architecture, tenant isolation, encryption, retention, erasure, and audit controls. Your implementation checklist records tenant-specific configuration and verification evidence. The GDPR processor artifacts are included in the onboarding diligence pack. Venturi does not hold a SOC 2 report, ISO/IEC 27001 or ISO/IEC 42001 certification, or a FedRAMP authorization. The post-onboarding roadmap at the end of this page lists SOC 2 and the ISO/IEC certifications with the other items outside the baseline.

SOC 2

SOC 2 status

Readiness program in progress; report not yet issued. SOC 2 Type I readiness/report target on our security roadmap with Type II targeted within 12 months; it is not yet held. Venturi does not hold a SOC 2 report or attestation.

Item Status
SOC 2 Type I Readiness program in progress on the audit-trail and policy-event foundation; report not yet issued. (Type I reports on control design at a point in time.)
SOC 2 Type II Targeted within 12 months of Type I, with the observation window starting immediately after Type I. (Type II reports on operating effectiveness over an observation period of typically 3 to 12 months.)
In-scope Trust Services Criteria Security (the Common Criteria, the one category every SOC 2 report must include), Availability, Confidentiality, and Processing Integrity. Processing Integrity is in scope because customers bill on the numbers Venturi produces; it covers the confidence-cap, abstention, and chargeback-eligibility controls. Privacy is added to the audit scope for EU or regulated-sector customer engagements.

The control foundation for the report is part of the onboarding baseline: the append-only audit trail, stored under S3 Object Lock, and the policy-event writer provide the tamper-evident control history that a SOC 2 examiner relies on. See the audit trail.

Penetration testing

A qualified third party performs a penetration test at least annually, and the first test is completed before the first production customer deployment. The test covers the API endpoints, authentication flows, and tenant data boundaries. Critical and high findings are remediated before the next customer deployment. The executive summary and remediation status of the latest test are in the in-product Trust Center and the onboarding diligence pack, and the full report is available on request under NDA. When a new test summary is published, the Trust Center notifies your subscribed security contacts.

GDPR

Processor framing

Venturi acts as a data processor; your organization is the controller. Venturi processes personal data only on your documented instructions and takes on the GDPR Article 28 processor obligations through the Data Processing Agreement (DPA), including the Art. 28(3) terms and the Art. 28(2) subprocessor change-notification and objection workflow. See Data-subject rights for how requests are fulfilled.

Onboarding privacy controls

  • Data minimization: content capture is structural, not configurable, and no setting turns it on, so Venturi processes invocation metadata, not prompt or completion content (GDPR Art. 5(1)(c)). See Data privacy & retention.
  • Cohort-only adoption intelligence: every cohort read path enforces a server-side minimum cohort of 5, with sub-cohort suppression, anti-differencing, and no individual-level view. See cohort-only adoption intelligence.
  • Crypto-shred erasure within 30 days, with a deletion certificate, reconciled with the append-only architecture.
  • Pseudonymized audit trail retained under a named legal-claims / legitimate-interest basis.

GDPR data residency

Per-tenant data lives in a dedicated tenant data plane: your cloud account in self-hosted mode, or a Venturi-operated single-tenant environment in SaaS mode. The residency lane is fixed during onboarding; applicable transfers use Chapter V safeguards. See Residency and subprocessors.

Onboarding privacy artifacts

Each artifact below is part of the customer-onboarding baseline.

Artifact Where you receive it
Formal DPA (Art. 28(3) terms; SCCs where Chapter V applies) Onboarding diligence pack and in-product Trust Center
Record of Processing Activities (RoPA, Art. 30) summary Maintained for in-tenant metadata processing and consent-gated cross-tenant aggregation; summary in the onboarding diligence pack and in-product Trust Center
DPIA template (Art. 35) and works-council pack Onboarding diligence pack, for customer adaptation
Lawful-basis mapping (per processing activity) Onboarding diligence pack
Dated, versioned subprocessor list Onboarding diligence pack and in-product Trust Center; see Subprocessors

Residency at onboarding is set by the contracted residency lane. The discrete customer-facing inference_geo control is on the post-onboarding roadmap.

CCPA

For consumers and businesses subject to CCPA/CPRA, Venturi operates as a service provider: it processes personal information only to provide the attribution service on your instruction, does not sell or share personal information, and processes only the metadata required for attribution. Access, deletion, and portability requests are fulfilled through the same mechanisms described in Data-subject rights, including the crypto-shred deletion path. The same data-minimization posture (no content capture, cohort-only adoption intelligence) limits the personal-information footprint by design.

EU AI Act

The EU AI Act applies to Venturi in two ways: Venturi’s own obligations as the provider of its attribution and adoption-intelligence system, and EU AI Act compliance automation as a product capability for your organization.

Deployment-specific classification

Venturi’s EU AI Act assessment follows the documented intended purpose, deployment context, provider and deployer roles, and actual use. The applicable law is Regulation (EU) 2024/1689, as amended, including Regulation (EU) 2026/1744. Qualified counsel determines the applicable classification, obligations, and effective dates for that use before EU market placement or putting into service. The European Commission’s enforcement timeline distinguishes provisions already applicable from the later Annex III and regulated-product high-risk rules.

The assessment addresses whether an Annex III use case applies, whether any Article 6(3) exception is available, and whether the system performs profiling of natural persons. Where applicable, Venturi prepares the documented assessment and completes the registration, transparency, monitoring, and other obligations required by the law in force for that classification and date. Registration is not a blanket requirement for every deployment.

Privacy controls do not determine legal classification

Adoption intelligence stays cohort-only: every cohort read path enforces a server-side minimum cohort of 5, with no individual-level view, emotion recognition, or behavioral-state inference about individual workers. These controls constrain the product’s use; a cohort threshold alone does not establish an Article 6(3) exception or a legal finding that profiling is absent.

The onboarding diligence pack records provider and deployer roles, applicable transparency duties, and the deployment-specific assessment. It includes a works-council pack for adaptation to the customer’s jurisdiction and workforce process.

Precautionary post-market controls

Venturi maintains post-market and serious-incident workflows as precautionary controls, alongside any duties applicable to the assessed deployment:

  • A post-market monitoring plan (Art. 72) that reuses the platform’s live calibration and drift monitors, the false-high-confidence and calibration-error gates, and the anomaly-detection system.
  • An AI incident runbook covering AI-specific failure modes (mass mis-attribution, a calibration or drift breach that triggers automatic fallback to the heuristic baseline, confidence inflation, and evidence poisoning) with detection, rollback, customer-notification, and post-incident-review steps.
  • The Art. 73 serious-incident reporting workflow, recorded in the RoPA, so the channel exists if a classification ever changes.

Compliance automation (product capability)

At onboarding, the attribution graph and the append-only audit trail record which AI system was used, by whom, and for what. Automated EU AI Act compliance reporting for your organization, which maps that attributed usage to framework obligations, is on the post-onboarding roadmap.

Control framework crosswalk

Venturi maintains a crosswalk mapping its onboarding-baseline controls to the principal governance frameworks: NIST AI RMF, NIST SP 800-53 / CSF, and ISO/IEC 27001 and 42001. Venturi does not hold ISO/IEC 27001 (Information Security Management System) or ISO/IEC 42001 (AI Management System) certification; the mapping supports diligence against those frameworks. The full crosswalk is on the Trust center.

Incident response & breach notification

A documented incident-response plan defines a Sev-1 to Sev-4 severity taxonomy anchored on customer impact, escalation tiers, and a post-incident-review requirement. Each severity sets a first-customer-notice deadline and an update cadence, from a first notice within 1 hour and an update every hour for Sev-1 to a first notice within 24 hours and an update every 24 hours for Sev-4; see customer notification commitments. As processor, Venturi notifies you of a personal-data breach without undue delay (target ≤ 24 hours of becoming aware) so you can meet your own 72-hour GDPR Article 33 deadline.

Operational incidents appear on the tenant-isolated in-product status surface at the app’s /status route, with the next update time and a written post-incident summary for material incidents. There is no shared public status page. Incident notices also reach you in-app and by email, Slack, and Microsoft Teams according to your tenant notification preferences. The operational and breach-notification paths run in parallel where both apply. See Status & incidents.

Post-onboarding roadmap

These items are outside the customer-onboarding baseline. They do not change any control described above.

Item Status
SOC 2 Type I and Type II reports SOC 2 Type I readiness/report target on our security roadmap with Type II targeted within 12 months; it is not yet held. No report has been issued.
ISO/IEC 27001 and ISO/IEC 42001 certification Not held. The control crosswalk maps controls to both standards.
inference_geo customer-facing residency control Not in the onboarding baseline. Residency is set by the contracted residency lane, pinned at deployment.
Automated EU AI Act compliance reporting for your organization Not in the onboarding baseline. The attribution graph and audit trail supply the underlying record.
Give feedback on this page

Sign in to send feedback. Opens in a new tab.

Copy page details 
Docs feedback: Compliance
Page: https://docs.venturi.systems/security/compliance/