SECURITY
What we check, and what we do not claim.
Security here is not a badge wall. It is a list of things that run on every build, a list of certifications we actually hold, and — the part most vendors leave off — a list of the ones we do not.
INTUIST · VEDA
01
VERIFICATIONS
16
automated checks on every build and edit
Intuist platform, September 2026
01 · VERIFICATIONS
16
automated checks on every build and edit
Intuist platform, September 2026
Six layers, on every build.
Not a quarterly checklist. These run when the code is written, which is the only moment at which they are cheap.
- INPUT GUARD
- Every user input is scanned for prompt injection, PII leakage, and adversarial patterns before it reaches any AI model.
- SANDBOXED EXECUTION
- All generated code runs in isolated Docker containers with no external network access. Zero blast radius by design.
- RED-TEAM TESTING
- Every app build runs through adversarial red-team testing — probing for XSS, injection, DOM vulnerabilities, and OWASP Top 10.
- 16 AUTOMATED CHECKS
- Every build and every edit streams 16 checks: 6 security, 7 quality, 3 performance. They run before any code goes live.
- END-TO-END ENCRYPTION
- Data encrypted in transit (TLS 1.3) and at rest (AES-256). API keys and credentials stored with envelope encryption.
- ZERO-TRUST ACCESS
- Email-verified passkey authentication with httpOnly cookies. No tokens in localStorage. Domain and email-level access control.
EACH ROW RUNS AUTOMATICALLY · NO ONE HAS TO REMEMBER IT
- SECURITY REVIEW AS AN ENGAGEMENT
- Pen-test style review and fixes for your own apps, sites, systems and clusters, scoped and delivered as an engagement.Intuist platform, September 2026
SCOPED SEPARATELY · NOT PART OF THE AUTOMATIC STREAM
INTUIST · VEDA
02
THE SEQUENCE
02 · THE SEQUENCE
From the message to the live app.
Five stations, in order. Nothing here is optional and nothing here waits for a person to press a button.
- 01
GUARD
Input Guard scans every message for injection, PII and adversarial patterns before the model sees it.
- 02
SANDBOX
The code is written inside an isolated container with no external network access.
- 03
CHECK
Twenty-four automated checks run — CSP headers, dependencies, DOM analysis, OWASP audit.
- 04
RED TEAM
Adversarial testing tries to break the build with XSS, injection and privilege escalation.
- 05
WATCH
In production, runtime errors are diagnosed and patched without waiting for a person.
- 01
GUARD
Input Guard scans every message for injection, PII and adversarial patterns before the model sees it.
- 02
SANDBOX
The code is written inside an isolated container with no external network access.
- 03
CHECK
Twenty-four automated checks run — CSP headers, dependencies, DOM analysis, OWASP audit.
- 04
RED TEAM
Adversarial testing tries to break the build with XSS, injection and privilege escalation.
- 05
WATCH
In production, runtime errors are diagnosed and patched without waiting for a person.
INTUIST · VEDA
03
CERTIFICATIONS
03 · CERTIFICATIONS
What we hold, and where to check it.
Every row below is auditable. The SOC 2 Type II report is available under NDA through the Trust Center.
- SOC 2 TYPE II
- Audit completed by an independent auditor, covering our controls for security, availability and confidentiality.Report available under NDA · trust.intuist.ai
- CASA
- Cloud Application Security Assessment, certified.
- GOOGLE CLOUD PLATFORM
- Deployed on GCP Cloud Run with auto-scaling, regional redundancy, and Google's enterprise-grade physical security.
- OWASP
- Every generated app is automatically audited against the OWASP Top 10 — injection, XSS, CSRF, and more.
- BAA
- Business Associate Agreements available for healthcare clients handling PHI under HIPAA requirements.Our own BAAs with Google Cloud, Google Workspace, OpenAI and MongoDB Atlas are executed · September 2026
HELD TODAY · SEPTEMBER 2026
INTUIST · VEDA
04
NOT CLAIMED
04 · NOT CLAIMED
The things we will not let you assume.
A vendor who lists only what they hold is asking you to infer the rest. Here is the rest, in the same type size.
“A trust score assesses the code Veda generated. It does not audit your deployment, your staff or how you handle your data. No other AI builder ships a verdict with its output at all.”
INTUIST AI · THE CAVEAT WE PRINT OURSELVES
- GDPR AND CCPA
- We do not claim GDPR or CCPA compliance, and we would rather tell you that than let you assume it.Full wording on /help
- HEALTH PRIVACY
- We do not claim HIPAA compliance. What is true today: our BAAs with Google Cloud, Google Workspace, OpenAI and MongoDB Atlas are executed, and we sign one with healthcare clients.Ask sales@intuist.ai for the agreement
- YOUR DEPLOYMENT
- A trust score assesses the code Veda generated. It does not audit your deployment, your staff, or how you handle your data.
- DATA RIGHTS, IN PRACTICE
- Access, export and deletion of your data on request, honoured within 30 days, across every system we store it in.Email privacy@intuist.ai
STATED PLAINLY · FULL WORDING ON /HELP
INTUIST · VEDA
05
ARCHITECTURE
05 · ARCHITECTURE
The boundaries your data flows through.
Three columns, no diagram. A hub-and-spoke drawing of a network is decoration; the boundary names are the fact.
- SANDBOX VMS
- VPC-isolated
- CODE EXECUTION
- No egress
- TRANSPORT
- TLS 1.3 everywhere
- EDGE
- GCP Cloud Armor WAF
NETWORK ISOLATION
- AT REST
- AES-256
- SECRETS
- Envelope encryption
- LOGS
- No PHI
- PII
- Automatic redaction
DATA PROTECTION
- PROMPT INJECTION
- Detected before the model
- ABUSE
- Rate limiting and throttling
- BEHAVIOUR
- Anomaly detection
- COVERAGE
- Monitored around the clock
THREAT PREVENTION
Ask for the SOC 2 report, a specific control, or a straight answer about an obligation we have not listed. You will get one either way.