Vind AI Data Security Overview

Last reviewed and updated October 2026

‍

Vind AI is certified to ISO/IEC 27001:2022, the international standard for information security management. This document gives IT and security teams an overview of how the Vind AI platform protects customer data, and how security is governed across our organisation. 

‍

1. Summary

Customer data is classified as Confidential, the highest level in our data classification scheme. It is never used in development or test environments, and it is securely deleted when no longer needed, in line with contractual commitments and applicable law.

‍

4. Encryption

All communication with the Vind AI platform is sent over HTTPS and encrypted in transit using TLS. Customer data is encrypted at rest using AES-256 server-side encryption managed by AWS, and backups are encrypted. Our use of cryptography follows our Cryptography Policy, which requires strong ciphers and configurations in line with vendor recommendations and NIST guidance, including NIST SP 800-57 for key management. Application secrets and credentials are stored in AWS Secrets Manager and are never kept in source code.

‍

5. Customer access and authentication

Authentication is handled by Auth0, a third-party identity provider certified to SOC 2 and ISO/IEC 27001. On request, customers can connect their own identity provider through single sign-on (SSO) with SAML or Microsoft Entra ID (Azure AD). Their own policies, such as multi-factor authentication and joiner/leaver processes, then apply to Vind AI access.

Once authenticated, a user receives a JSON Web Token (JWT) valid for 10 minutes. Authorisation is not embedded in the token: our authoriser evaluates the user's current team and project permissions on every request, so access changes take effect within seconds. Tokens are renewed with single-use, rotating refresh tokens. Auth0 Refresh Token Rotation is used to detect leaked tokens automatically.

Data belonging to different teams and projects is logically separated, and every request to our APIs is authenticated and authorised.

‍

6. Internal access control

Access to Vind AI systems is granted on the principle of least privilege, using role-based access control. Permissions not expressly granted are denied by default. In particular:

• Multi-factor authentication is required for all AWS user accounts and for all privileged access to production infrastructure.
• Development access and administrative access are separated, and both use temporary access keys. Root accounts are not used for daily operations.
• Access to production systems is restricted to authorised personnel, and all privileged logins and activity are logged.
• Access rights are reviewed at least annually and on any change of role.
• Access is revoked promptly when an employee or contractor leaves.

‍

7. Infrastructure and secure configuration

The Vind AI platform is built primarily on managed and serverless AWS services, minimising exposed infrastructure. All production and supporting systems follow a documented Secure Configuration Baseline aligned with AWS security best practices, CIS Benchmarks where applicable, and NIST guidance. The baseline requires, among other things:

• Encryption at rest for all storage services, with public access to storage blocked by default.
• Default deny for inbound network access, with firewall rules limited to required ports.
• AWS account and API activity is logged through CloudTrail.
• Infrastructure managed through version-controlled configuration where applicable.
• Regular updates and security patches, with unnecessary services and ports disabled.

Development, test and production environments are strictly segregated.

‍

8. Secure development and change management

Security is built into our development lifecycle through secure-by-design and privacy-by-design principles, defined in our Secure Development Policy.

• All significant code changes are peer reviewed and approved before they are merged to production, and no single individual can develop, test and deploy a change without oversight.
• Changes are tested in environments separate from production, and a release checklist confirming completed tests is required before deployment.
• Code is scanned with GitHub Advanced Security (CodeQL), and dependencies are monitored for known vulnerabilities with Dependabot and Snyk.
• The application, support systems, back ends and authorisation system are tested automatically to detect and alert on issues.
• Developers complete secure development training at least annually, covering common web application attacks such as injection, cross-site scripting and authorisation bypass.

‍

9. Threat detection and vulnerability management

Vind AI monitors for threats at several levels:

• AWS GuardDuty continuously analyses logs, events and network traffic to detect malicious activity in our AWS environment.
• Production systems log authentication events, errors and security-relevant activity, and alerts are configured for critical events such as failed logins and system anomalies. Logs are protected against unauthorised modification.
• Vulnerabilities identified by automated tools, cloud provider alerts and security advisories are reviewed by engineering and prioritised by severity. Critical and high vulnerabilities are addressed as soon as possible. 
• Independent third parties perform penetration tests of the platform at least annually, and a formal risk assessment is carried out every year.

‍

10. Incident response

Vind AI maintains a documented Incident Response Plan that is reviewed and tested at least annually. Incidents are prioritised by severity and handled through a defined process, from triage and containment through recovery, followed by a root cause analysis to prevent recurrence.
‍

Our Data Protection Officer and legal counsel are involved where personal data or regulatory obligations are affected. Confirmed breaches affecting customer data are reported to affected customers without undue delay, in accordance with our Data Processing Agreement and applicable law, including GDPR.
‍

Security concerns or suspected incidents can be reported to incident@vind.ai.

‍

11. Business continuity and availability

Our Business Continuity and Disaster Recovery plan is tested annually, including restoration of backups. As a cloud-based organisation, our operations do not depend on a single physical office, and all staff can work securely from any location.

‍

12. People and endpoint security

• Background checks are carried out in line with local laws and proportionate to the role.
• All employees and contractors sign confidentiality agreements and formally acknowledge our information security policies before they are given access to any system.
• All staff complete security awareness training at onboarding and annually.
• Company laptops use full-disk encryption, password or biometric authentication, automatic screen lock and anti-malware protection with automatic OS security updates.

‍

13. Third-party providers

Every service provider that may access confidential data undergoes a security assessment before it is engaged, and is reviewed at least annually. Written agreements set out each provider's security and confidentiality obligations. Core platform components, including AWS, Auth0, Ably and GitHub, hold SOC 2 and/or ISO/IEC 27001 certifications.

‍

14. Privacy

Vind AI processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act, and has a designated Data Protection Officer. Personal data is deleted or de-identified as soon as it no longer has a business purpose. See our privacy notice and DPA. 

‍

15. Disclaimer

This document is for informational purposes only and represents Vind AI's current product offering and practices, which are subject to change. The responsibilities and liabilities of Vind AI to its customers are governed by Vind AI's terms and conditions.

‍

‍

‍