Security & trust
Built like it guards something.
Vevang’s trust model is structural, not policy. The guarantees below aren’t promises in a handbook — they are constraints welded into the database and the agent runtime, the same way on every plan, for every customer. The honesty is the feature.
The mechanisms
Eight guarantees, each with its mechanism
The covenant
Agents propose. You approve.
Every agent action lands as a proposal with its evidence attached — the invoices, entries, or documents that justify it. A human confirms on their own session, or dismisses. Autonomy is earned and governed, never assumed.
Money-out
Money-out is human-only — welded at the database.
Eight money-out action classes — refund, bill payment, payout, distribution, retainage release, tax payment, capital return, payroll — are platform-locked to propose-only at maximum autonomy. The platform cannot be configured to auto-pay. Forever.
Audit
Every step on the record.
The activity spine, agent run steps, and agent charters are append-only — nothing is edited in place. Every agent run has a step-by-step trace, and every row drills through to the real artifact: the actual email, document, or journal entry.
Isolation
Isolation enforced by the database.
Row-level security scopes every query to the caller's own identity — per-tenant in Command, per-user in Finance. Operator surfaces fail closed with a 404 indistinguishable from no route. Enterprise adds project-per-tenant isolation.
Deterministic money
No LLM ever computes a money figure.
Reconciliation matching is a deterministic engine. Reports are computed from posted lines — there are no cached balances anywhere. Cited answers are calculated by a closed set of read-only tools, and a fabrication guard rejects uncited figures.
Least privilege
Read-only by default, consent-scoped always.
Bank, card, loan, and brokerage connections via Plaid are read-only. Google scopes are minimal (gmail.readonly, drive.readonly) and CASA-approved. Every connection shows its exact scopes and can be paused or revoked in one click.
Encryption
Tokens vaulted, encrypted, keyed outside the DB.
Bank and Google tokens are encrypted at rest with AES-256-GCM and the key lives outside the database — the database stores only a pointer. A full security-header set ships on every response, with a published security.txt.
Failure honesty
Kill switches and honest degradation.
Global and per-tenant kill switches are re-checked when work is queued AND when it's claimed. When a read fails, the tile dims and says why — the system never shows a fake 0 or a stale number in place of the truth.
Your data
Yours to feed it. Yours to take back.
Everything you connect or upload exists to answer your questions — it is never sold, and documents are treated as untrusted input (a deliberate defense against prompt injection hiding in a PDF). Vevang Finance ships a full JSON export of your data and true account deletion: Plaid connections removed, Google access revoked, stored documents wiped. The public delete-account page documents exactly what deletion does.
Google access — Gmail, Drive — passed Google’s independent CASA security assessment (approved July 2026) on minimal read-only scopes. Every connection in both products shows its exact scopes, its feed health, and a working pause / re-consent / disconnect control.
Straight answers
Security questions, answered plainly
Can Vevang's AI move money out of my accounts?
No. Vevang Finance connects to your banks read-only (via Plaid) and to Google with read-only scopes — there is no write path to your money at all. In Vevang Command, the eight money-out action classes (refunds, bill payments, payouts, distributions, retainage releases, tax payments, capital returns, payroll) are locked at the database to propose-only: an agent can stage a payment for review, and only a human can confirm it. That is a database constraint, not a setting.
How is my data isolated from other customers?
Isolation is enforced by the database, not by app discipline. Every read and write runs under row-level security on the caller's own identity — per-tenant in Command, per-user in Finance — so a query physically cannot return another customer's rows. Operator-only surfaces fail closed: a non-operator gets a 404 indistinguishable from no route existing.
Does the AI make up numbers?
It can't, structurally. Money figures are computed deterministically in code — reconciliation suggestions, report totals, and cited answers all come from real posted data, and no LLM ever computes a money figure. In Command's Ask, a closed allow-list of read-only tools computes every number, each figure carries a citation to the exact source row or document, and a fabrication guard rejects any citation of data the tools didn't return.
What did Google's security review cover?
Vevang's Google integrations (Gmail, Drive) passed Google's independent CASA security assessment, approved in July 2026. The scopes are minimal and read-only — gmail.readonly and drive.readonly in Finance — and OAuth tokens are encrypted at rest with AES-256-GCM, with the key held outside the database. You can pause, re-consent, or disconnect any connection at any time.
Who owns my data?
You do. Your data is never sold. Finance offers a full JSON export (“Download my data”) and true account deletion — Plaid connections removed, Google access revoked, and stored documents wiped. Documents you feed the system are treated as untrusted input (a deliberate prompt-injection defense), read for your benefit only.
What happens when something breaks?
It says so. A failed read dims its tile with the reason — never a fake zero. Failures are first-class red rows in the activity log, agent runs keep an append-only step-by-step trace, and kill switches (global and per-tenant) are re-checked both when work is queued and when it's picked up.
Trust is infrastructure
The constraint is the feature.
Software that can’t auto-pay, can’t invent a number, and can’t read another tenant’s rows is software you can hand real work to. That’s the whole idea behind an AI Operating Partner.