Security & Compliance

We prioritise the responsible management of data and the trust our clients place in our services. Data privacy and security are fundamental to our mission of empowering enterprises with reliable, production-grade AI infrastructure.

We understand the importance of transparency and accountability in the field of AI consulting, and we actively embrace open communication and ethical practices.

1. Our Commitment to Trust

Our commitment to trust is reflected in our:

• Robust security measures: We implement industry-leading safeguards to protect client data from unauthorised access, use, or disclosure.
• Adherence to industry standards: We comply with UK GDPR, the Data Protection Act 2018, and adhere to industry best practices.
• Transparency and accountability: We provide clear and accessible information about our data handling practices and policies.
• Operator-first mindset: We think like the engineers who get paged at 3 a.m. Every recommendation comes from hands-on production experience.

2. Vulnerability Reporting

To report security vulnerabilities, please contact the Vantagea security team by emailing admin@vantagea.io with the subject line "Responsible Disclosure".

All reported vulnerabilities will be tracked and acknowledged within 48 hours. We appreciate the security research community's efforts in helping us maintain a secure environment.

3. Client Data Security

Data Access

We follow the principles of least privilege and need-to-know basis. Access to client systems and data is strictly controlled and audited.

• All client engagements operate under signed NDAs and Data Protection Agreements
• Access credentials are never shared and are rotated regularly
• We maintain detailed access logs for all client environments

Encryption

• Encryption-at-rest: All client data stored on our systems is encrypted using AES-256 encryption.
• Encryption-in-transit: All communications use TLS 1.3 encryption protocols.

Data Retention

Client data is retained only for the duration of the engagement plus any legally required retention period. Upon project completion, clients can request full data deletion, and we provide written confirmation of data erasure.

4. Infrastructure Security

Cloud Security

For client engagements, we work within your existing cloud infrastructure. When Vantagea-managed infrastructure is required, we utilise:

• AWS and GCP: Enterprise-grade cloud providers with SOC 2 Type II, ISO 27001, and other compliance certifications
• Infrastructure as Code: All infrastructure is version-controlled and auditable using Pulumi
• Network Segmentation: Strict network controls and private subnets for all sensitive workloads

Endpoint Security

• Full disk encryption on all Vantagea devices
• Endpoint detection and response (EDR) solutions deployed
• Mobile device management (MDM) for company-owned devices
• Hardware security keys for multi-factor authentication

Production Environment Practices

When working with client production environments:

• All changes go through documented change management processes
• Rollback procedures are established before any deployment
• We never make changes without explicit client approval
• All actions are logged and auditable

5. Application Security

Secure Development Lifecycle

We follow secure development practices aligned with OWASP guidelines:

• Security requirements are defined at project inception
• Code reviews include security considerations
• Dependencies are scanned for known vulnerabilities
• Regular security assessments of delivered solutions

AI/ML Security

Given our focus on AI infrastructure, we implement additional safeguards:

• Model access controls and authentication
• Prompt injection prevention measures
• Output validation and sanitisation
• Audit logging for all model interactions
• Data lineage tracking for training data

6. Access Control

Authentication

• Single Sign-On (SSO) integration for enterprise clients
• Hardware-based Multi-Factor Authentication (MFA) required for all Vantagea personnel
• WebAuthn-compliant authentication methods
• Session management with automatic timeouts

Role-Based Access Control

• Predefined security groups for client environments
• Principle of least privilege enforced
• Regular access reviews and recertification
• Immediate access revocation upon engagement completion

7. Compliance & Certifications

Regulatory Compliance

Vantagea operates in compliance with:

• UK GDPR: Full compliance with UK data protection regulations
• Data Protection Act 2018: Adherence to UK data protection law
• PECR: Privacy and Electronic Communications Regulations compliance

Industry Standards

We align our practices with:

• ISO 27001: Information security management principles
• SOC 2: Trust service criteria for security, availability, and confidentiality
• NIST Cybersecurity Framework: Risk management and security controls

8. Incident Response

Security Incident Management

A formal incident management framework has been established that defines:

• Roles and responsibilities
• Escalation paths
• Internal and external communication requirements
• Post-incident review processes

Notification

In the event of a security incident affecting client data:

• Clients will be notified within 72 hours of discovery
• Full incident reports provided upon request
• Remediation plans shared and implemented promptly

9. Business Continuity

Disaster Recovery

• Business continuity and disaster recovery plans are maintained and tested
• Critical data is backed up with geographic redundancy
• Recovery time objectives (RTO) and recovery point objectives (RPO) are documented

Availability

• We provide status updates for any service disruptions
• Regular testing of backup and recovery procedures
• Documented failover processes

10. Personnel Security

Employee Vetting

• Comprehensive background checks for all personnel
• Regular security and privacy training (at least annually)
• Confidentiality agreements and code of conduct

Security Training

All Vantagea personnel complete:

• Security awareness training upon joining
• Annual refresher training on security policies
• Role-specific security training for engineering staff
• Incident response training and tabletop exercises

11. Third-Party Security

Vendor Management

• Due diligence performed on all third-party vendors
• Security requirements included in vendor agreements
• Regular review of vendor security posture

Subprocessors

A list of subprocessors and their security practices is available upon request. All subprocessors are bound by data protection agreements.

12. Contact Us

For security-related inquiries, please contact:

Vantagea Ltd
Email: admin@vantagea.io

Company Number: 14751439
71-75 Shelton Street
Covent Garden
London, WC2H 9JQ
United Kingdom

We are committed to building trust through responsible AI infrastructure. If you have any questions about our security practices, please do not hesitate to reach out.