TrustSecurity and trust
Secure by construction.
Velenza was built by a security architect, from the foundation up, for a system that would hold a company’s most sensitive operational data. The controls below are not features on a roadmap. They are how the platform works.
Every
- Every action
Checked against policy before it runs.
- Every customer
Isolated by design.
- Every transaction
A way to undo it, confirmed before it starts.
- Every claim
Graded against what happened.
- Every key
Post-quantum wherever it is generally available.
We are pursuing SOC 2 deliberately rather than scrambling for it; the control map an auditor works through is largely a description of choices already made in the architecture.
01 · Nothing runs without a decision
Every action that can cause an effect is checked against the gate, automatically. There is no way for an action to skip it.
What policy clearly allows proceeds on its own. Anything else waits for a person, through the same gate, never a side door.
A permission you changed five minutes ago is the permission that applies.
The decision is derived from the facts of the action, the policy and the identity asking. There is no priority field for an integration to set wrongly.
The reasoning half proposes. A separate deterministic layer owns every effect and every byte of stored state.
Every deployment begins read-only.
02 · Your data
Never pooled or commingled with another customer’s. Built in, not filtered.
Not ours, not a provider’s; excluded by the inference terms.
Take it out in full. On termination, it is deleted, not retained.
Business fields encrypted again at the column level.
No separate Velenza password to manage, or for us to lose.
The service dependencies underneath are shared under review rather than published. A public list of everything a platform runs on is a map for anyone probing it.
03 · Acting on systems you do not own
You cannot own another company’s transaction.
A call to raise an invoice times out halfway through. Did it post? Fire it again and you may have billed a customer twice. Do nothing and you are silently short a real invoice. Velenza never lets that question stay open.
- Completed
Finished in full, verified. Never left half-done.
- Reversed
The undo path was confirmed before the action ever ran.
- Parked for a person
Never a guess, never rounded to success.
Always exactly one of these three. They describe what Velenza can verify on its own side, never a claim about your vendor’s system. We won’t claim a record there cannot be altered. No platform honestly can.
04 · Post-quantum
Built to outlive the computers meant to break it.
Data harvested today can be decrypted later, so the time to move is before the break. Velenza is post-quantum by default: the keys and signatures it controls use the NIST post-quantum standards wherever Google Cloud offers them in general availability. Where a capability is still in preview, it stays out of production. Nothing falls back to an old algorithm where a post-quantum path exists.
Every signature Velenza makes, on a receipt or a record, uses ML-DSA (FIPS 204) through Cloud KMS, generally available since 16 July 2026.
Key establishment uses ML-KEM (FIPS 203) through Cloud KMS, generally available, with the hybrid form recommended by Google Cloud.
Connections Velenza terminates negotiate hybrid post-quantum key exchange (X25519MLKEM768) with every client that supports it.
A connection to a system you run uses post-quantum transport when that system supports it. When it does not, the connection is recorded exactly as negotiated and upgraded the day the partner can.
Checked against Google Cloud’s published availability on 15 October 2026. Quantum-safe key import is still in preview and is not claimed. As a capability moves from preview to general availability, it moves into production; never the other way round.
05 · Being wrong
Models are wrong sometimes. Velenza is built for that.
The worst outcome of a wrong conclusion is a wrong proposal, held at a gate, reviewed by a person against the record. Not a wrong payment.
A conclusion arrives with the records it was drawn from.
Before the outcome exists, then graded when it does. The calls it got wrong stay on the page.
The only durable defense against a plausible-sounding wrong answer.
Accuracy figures belong to your deployment, measured on your data, against calls written down before their outcomes existed.
Security review
Send us your questionnaire.
If you are assessing Velenza for someone else, send the standard questionnaire and we will work through it with you, control by control, against the architecture.