.png&w=3840&q=75)
Role-based permissions
Choose what each user can view, create, approve or change.
Velox security
Your data stays yours.
Protected by design.
Velox runs the orders, stock, customers and finances of your distribution business. We keep that data separate, controlled and safe — while giving you a choice of where it lives.
Separate by default
Every customer has an isolated data boundary.
Access with intent
Visibility follows role and distributor scope.
Built for the field
Offline mobile work stays scoped to its user.
Data architecture
One platform.
Clear boundaries.
Each customer's data lives in its own isolated area of the database. Within your organisation, data is further scoped by role and distributor, so people see only the records that belong to them.
Data scope
A customer boundary, then a team boundary
Tenant boundary
Your organisation
Your data is separated from every other Velox customer.
OrdersInventory
Access scope
Your teams
Role and distributor visibility determine what is available.
Admin
Sales team
Distributor
Access you control
The right access,
at every level.
Give people the tools they need without exposing records outside of their responsibilities.
Distributor-level visibility
Distributor teams see only the customers, orders and records assigned to them.
Secure sign-in
Standards-based authentication for web, operations and mobile apps.
Due-diligence pack
Answers for your security review.
We provide a security overview and complete customer due-diligence questionnaires during procurement. Deployment, residency, recovery objectives and support commitments are confirmed in your order form and service agreement.
Review areaWhat we cover
Hosting & residency
Hosting provider, region and available deployment/residency options
Resilience
Backups, disaster recovery, RPO and RTO for the selected service
Protection
Encryption in transit and at rest, access controls, MFA and audit logging
Assurance
Incident and breach notification, subprocessors, testing and certification status
Commercial
Uptime target, support SLA and data-processing agreement
Velox does not claim SOC 2 or ISO 27001 certification on this site. If certification becomes available, its scope and current status will be published here.
Deployment flexibility
Choose where Velox runs.
Select the model that fits your operational, security and data-residency requirements.
Fast start
SaaS
Hosted and managed by Velox on shared cloud infrastructure, with data isolated per customer.
Best for
Teams that want to start quickly
Dedicated
Private SaaS
A dedicated Velox environment, hosted and managed by us for your organisation only.
Best for
Enterprises that need isolation without running servers
Maximum control
On-premises
Velox runs in your own data centre or private cloud, under your security rules.
Best for
Organisations with strict data residency or security requirements
Built for the field
Secure mobile,
even offline.
The Velox mobile app keeps working without a connection and synchronises when it is back online. Each device only receives data its signed-in user is allowed to see.
Scoped device data
Only assigned records
A device receives only data its signed-in user can see.
Resilient offline work
Work synchronises when the connection returns.
Privacy and data protection
- Your data, your control. We process your data only to provide Velox.
- You can request return or deletion of data at the end of your contract.
- A data processing agreement is available for every customer on request.
- Documents and files are stored in secure, S3-compatible object storage.
Security collaboration
- We can answer your security questionnaire and take part in your due-diligence process.
- Talk with our team about your deployment requirements.
- Velox is designed to support customers' compliance with data protection laws, including the GDPR.
Due-diligence pack
Clear answers for your security review.
Download the security overview for a concise procurement summary. We also complete customer questionnaires and provide a DPA on request.
Download security overview PDFEnvironment-specific commitments are confirmed in your order form and service agreement.
Control areaCurrent disclosure
Hosting provider & region
Confirmed for the selected SaaS or private-cloud environment in the security overview and order form.
Data residency
Private SaaS and on-premises deployment options support customer residency requirements; the selected region is documented in the order form.
Backups & disaster recovery
Backup, recovery and disaster-recovery arrangements are documented for the selected service. RPO and RTO are agreed in the service agreement.
Availability & support
Uptime target and support response commitments are defined in the applicable service agreement or order form.
Encryption
Data is protected in transit and at rest. Documents and files use secure, S3-compatible object storage.
Identity & logging
Role-based access is available. MFA and audit-logging scope are confirmed for the selected deployment during security review.
Incident & breach notification
Notification process and contractual timing are provided in the applicable service agreement.
Subprocessors & testing
Current subprocessors and penetration-testing scope or summaries are available during due diligence on request.
Current certifications
SOC 2: not currently claimed
ISO 27001: not currently claimed
Certification roadmap
No public SOC 2 or ISO 27001 certification timetable is currently published. If certification becomes available, its scope and status will be published here.
Talk to our team
Security questions deserve direct answers.
Need a DPA, a security questionnaire answered, or a conversation about on-premises deployment? Our team is ready to help.
Contact security team