Background checks, training, least‑privilege access — and the kind of culture where pushing back on a risky deploy is welcome.
The infrastructure your data sits on. Encryption at rest and in transit by default — and we use the same SOC 2'd subprocessors your enterprise vendors do.
How your data flows through VesperWise — and what we deliberately don't do with it (e.g. train models on it).
How we ship, audit, and respond. Including the postmortem you're allowed to ask for after any incident — they're written for customers, not just internal.
Five hops from a customer’s browser to a scored response. Encryption in transit at every hop; nothing’s logged that doesn’t need to be.
For the full subprocessor list with regions, transfer mechanisms, and DPA links, see Subprocessors. We notify account owners 30 days before any change to this set.
If a control isn’t here, it’s because we don’t run it — and we’ll tell you that, in writing, instead of waving the SOC 2 report.
intentiq.dev uses TLS 1.3 with strong ciphers; HSTS preloaded on the apex; certificates from Let’s Encrypt auto‑rotated every 60 days. Internal service‑to‑service hops use mTLS where the subprocessor supports it.Pre‑filled questionnaires, the SOC 2 report, the DPA, and a one‑pager you can drop into a security review.
We pay bounties up to $5,000 for severe issues, settled in 14 days. No legal threats for good‑faith research. Encrypt your report with the PGP key on the right — or just email security@intentiq.dev in the clear.