Access control, enforced tool by tool
Every user has a role, and every role has an explicit list of tools it may use. Your accountant can query the accounts but not read the inbox; warehouse staff can check stock but never see payroll. Permissions are verified on every request at the server — not just hidden in the interface.
Encryption and authentication
All traffic runs over HTTPS. Credentials for your connected systems are stored encrypted, requests are authenticated with signed tokens, and multi-factor authentication is available to every account and required for owners. Each client gets its own connector server, and every record in our database is tagged to the business it belongs to: our servers scope every query to the business making the request, and row-level security in the database guards its public interface as a second barrier.
A full audit trail
Every query is recorded: who asked, what they asked, which tools were used, and when. Owners can review their team's activity at any time. Tools that change data — sending, updating, logging — show a preview first and act only once confirmed. The exceptions are ones you choose: an automation you have agreed in writing may act on its own, and an owner can switch a routine action to “don’t ask”.
Your data is never used to train AI
Your business data — invoices, emails, stock levels, customer records — is never used to train or improve any AI model, and we never sell data to anyone. AI processing is covered by a data processing agreement with our provider, with recognised UK transfer safeguards in place.
Named, andcounted.
Vesuvian is built and operated in the United Kingdom, and the platform is hosted on UK and EU infrastructure. We work with a small, named set of subprocessors — this is the whole list.
| Anthropic PBC | AI query processing | USA (transfer safeguards in place) |
| Supabase Inc. | Database hosting | EU |
| Vercel Inc. | Application hosting | UK (London, lhr1 region) |
| Railway Corp. | Connector (MCP server) hosting | EU |
| Google LLC | OAuth sign-in, Gmail API email, and website analytics (analytics with consent) | USA (transfer safeguards in place) |
| Sentry | Error monitoring | EU |
Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. Full detail, including retention periods and your rights, is in our privacy policy.
What wedeliberatelydon’t do.
- We never use your data to train or improve AI models.
- We never sell your data, to anyone, for any reason.
- We do not keep the files you attach to conversations — the original is deleted automatically within 24 hours.
- We do not let the AI change your data unasked — every tool that changes data waits for confirmation, unless you have agreed in writing that an automation may act on its own, or an owner has switched that action to “don’t ask”.
For your accountant, IT advisor or DPO
A Data Processing Agreement is available for every client, and we are happy to walk your advisors through the architecture, the data flows and the controls before you commit to anything.
Vesuvian Limited is registered with the Information Commissioner’s Office, registration number ZC187854.
Found a potential vulnerability? Report it to support@vesuvian.uk — we acknowledge reports within 24 hours.