Trust and security at Veteros

How Veteros protects clinic data. Veteros is preparing for a SOC 2 Type II audit and is designed to support clinics with their GDPR and UAE PDPL obligations.

Security overview

Encryption at rest: visit audio, documents and stored secrets are encrypted with AES-256-GCM before they are stored.
Encryption in transit: the app is served over HTTPS, and session cookies are secure and HttpOnly.
Tenant isolation: every request runs with the clinic organization taken from the session, and the database enforces row-level security on every clinic table.
Access control: six roles with clinic-level scopes, two-step sign-in with an authenticator app, single sign-on (OpenID Connect) and organization policies such as session length.
Audit: changes and sign-ins are recorded in an append-only audit log that owners and admins can review and export. Quarterly access reviews are kept as evidence.
Hosting and backups: the app runs on Vercel with its functions in Frankfurt, Germany, and the database runs on Supabase in Frankfurt (eu-central-1), which takes daily backups.

AI and clinic data

AI features use Google Gemini only under Google’s paid terms (the paid Gemini API or Vertex AI). The free tier is refused when the app starts.
Under those terms, Google does not use the data to train or improve its models. Veteros never uses clinic data to train models either.
AI output is a draft. A person signs every note and approves every message to a client.
Prompts carry what the task needs: no owner names, and large files are deleted from the provider right after use.

Google’s terms for the Gemini API: Gemini API Additional Terms of Service

Privacy

For clinic data (clients, pets, visits, notes, recordings), the clinic decides and Veteros processes on its behalf. For staff accounts, Veteros is responsible.
Pet owners make requests (access, correction, deletion and others) to their clinic. Veteros gives the clinic the tools to answer them on time.
Each clinic sets how long recordings and transcripts are kept (by default 30 days for audio and 365 days for transcripts). Exports are deleted after 7 days.
Development and testing use made-up data only; real clinic data never enters them.

Sub-processors

The companies that process data on behalf of Veteros.

Last changed 2026-11-09.

Company	Purpose	Data	Location	Transfer safeguard
Vercel Inc.	Hosting the application	Everything the application processes, in transit and in memory	Frankfurt, Germany (EU) for app functions	The provider's data processing agreement
Supabase	The database	Everything stored in the database: records, notes, accounts and audit history	Frankfurt, Germany (eu-central-1)	The provider's data processing agreement
Cloudflare R2	Encrypted audio and document storage	Visit audio, documents and exports, encrypted by Veteros before they are stored	Cloudflare R2 (data at rest encrypted by Veteros)	The provider's data processing agreement
Google LLC (Gemini API, paid tier, or Vertex AI)	Speech to text and drafting of notes, summaries and messages (drafts a person reviews)	Visit audio, transcripts, clinical note text, record documents, staff questions; no owner names in prompts	Google facilities worldwide (paid Gemini API)	The provider's data processing agreement
Creem	Payments as merchant of record: subscription checkout and customer portal hosted by Creem	Organization name, owner email, seat count, plan and billing status; no card data reaches Veteros	The provider's data processing agreement	The provider's data processing agreement
Resend	Sending email: invitations, notices and client messages a person approved	Recipient email address, subject and message text	The provider's data processing agreement	The provider's data processing agreement
Mixpanel	Product analytics: which features teams use, sent from the Veteros server	Pseudonymous person and team ids (hashed), role, plan, country, event names and counts; no names, emails, clinical or client data, no IP address	European Union (Mixpanel EU data residency)	The provider's data processing agreement

Organization owners can ask for an email when this list changes, in Settings, Security.

SOC 2 readiness

In preparationVeteros is preparing for a SOC 2 Type II audit: controls are mapped to the Trust Services Criteria and evidence is being collected. No audit has taken place yet, and there is no report to share.

Veteros is designed to support clinics with GDPR and UAE PDPL obligations. This page is not legal advice.

Reporting a security issue

If you find a security problem, tell us privately and give us time to fix it before sharing it. Please do not access data that is not yours.

Security and privacy contact: support@veteros.com

Policy drafts

The policies behind these controls, as drafts under review. They are not final and are not legal advice.