Security architecture
Isolation By Design,
Not By Policy
Your documents never touch shared infrastructure. Here's how the architecture enforces privacy at every layer.
How it works
Architecture overview
Three layers of isolation between your browser and your data.
Security pillars
Four layers of protection
Dedicated GPU Instances
Each vault is provisioned on its own dedicated GPU instance rather than a shared pool — separate storage and separate processes from any other customer’s vault.
Encrypted Transport
Uploads travel over TLS to VaultAI, which relays them to the dedicated GPU instance provisioned for your vault. This is not end-to-end encryption, and VaultAI adds no encryption at rest of its own on the instance.
Single-Tenant Architecture
VaultAI handles provisioning, routing and billing. Your document content is stored and processed on the instance provisioned for your vault — not on shared infrastructure, and never used to train models or shared with third parties.
Network Isolation
Your vault runs on hardware rented for you alone. The instance pulls its model weights at startup and runs inference locally, so no third-party AI API ever sees your documents.
Data lifecycle
From upload to destruction
Every stage of the document lifecycle is designed for isolation and ephemeral processing.
Upload
Documents uploaded over TLS and stored on your GPU instance's local storage.
Process
Documents chunked and embedded locally using open-source models. Vector index stored in-memory only.
Analyze
All inference runs locally on your dedicated GPU. No data leaves the instance.
Destroy
GPU instance terminated. Local storage wiped. Vector index destroyed. No recoverable data remains.
Compliance
Designed to support your compliance requirements
Dedicated Instances
Each vault runs on a GPU rented for you alone and deleted when you destroy it.
GDPR Ready
Right to deletion built into every vault, plus self-service data export.
Audit Log
A timestamped record of vault and document actions in your account.
Attorney-Client Privilege
No third-party access. Documents stay in your isolated environment.
These labels describe how VaultAI is built, not certifications we hold. VaultAI has not been audited or certified against HIPAA, GDPR, SOC 2 or SOX, and we do not sign a BAA today. What we provide is the technical infrastructure to support your own compliance work; certification depends on your organization's overall security posture and implementation.