TRUST & POLICY
How VELA handles data.
VELA was built on a single architectural principle: your data never leaves your jurisdiction. This page documents what that means in practice — the controls in place, the credentials in progress, and the gaps we have named.
Sovereign by design — not a configuration option.
Cloud AI sends every query — and the documents behind it — to an externally hosted model. VELA does not. All inference happens inside the client environment, against infrastructure the client controls.
For institutions in the Bahamas, Cayman Islands, and British Virgin Islands — none of which hold an ICO adequacy decision — this eliminates the UK GDPR Chapter V cross-border transfer obligation rather than managing it. There is no transfer to safeguard.
- Outbound API calls
- None.Zero calls to OpenAI, Anthropic, AWS, Azure, or any external model host during query processing.
- Document storage
- Client environment only.CORPUS_ROOT is a local path. Not in OneDrive, SharePoint, or any cloud sync service.
- Inference engine
- Local NVIDIA NIM endpoint.LLM inference runs against an on-premise GPU endpoint. No remote model host.
- Code repository
- No remote..git/config has no [remote] section. The corpus is not synchronised to any hosted repository.
- Chapter V obligation
- Eliminated at architecture level.No data movement = no transfer = no obligation. No SCC, IDTA, or adequacy decision required.
- SM&CR audit trail
- Machine-generated on every query.Every query logged with user, timestamp, question, response, source document, section, and clause.
What is in place, what is in progress.
- Active
NIST AI RMF Compliance Register
119 entries · 19 automated verification gates · ERRORS 0 · WARNINGS 0. Version-controlled. Nightly-verified.
- Certified
Cyber Essentials Certified
Certificate No. 8368bca9-c891-4066-b0d3-55fbd7061c09. Issued by Forensic Control / IASME, 10 November 2026. Valid until 10 November 2027.
- Pending Confirmation
UK GDPR Article 27 Representative
UK representative appointed under Article 27. ICO registration in progress.
- Active
ITC / FCDO Trade Mission
Selected as 1 of 8 Caribbean technology companies for the 2026 ITC Making Trade Happen UK trade mission. UNCTAD/WTO agency, FCDO-funded.
- Active
Data Processing Agreement (DPA)
Executed with every client engagement. Defines processing scope, controls, and deletion obligations.
- Roadmap · Q3 2027
ISO 27001:2022
Target certification Q3 2027. Gap named. Timeline confirmed.
Cova Systems is a data processor. The client is the data controller.
The client decides what documents VELA reads, who can query them, and how long they are kept. Cova Systems processes that data only on the client's documented instructions.
All processing takes place inside the client's own jurisdiction and environment. On exit, all client data held within the VELA deployment is deleted within 7 days.
| Step | Control | Evidence |
|---|---|---|
| Receive | Documents are loaded by the client directly into their own environment. Nothing is uploaded to Cova Systems. | Ingestion log entry per document |
| Store | Corpus held at a local CORPUS_ROOT path. No cloud sync, no hosted repository. | Path configuration · .git/config with no [remote] |
| Handle | Inference runs on a local NVIDIA NIM endpoint. Zero outbound model calls. | Network egress logs |
| Check | Every query and response is logged with user, timestamp, source document, section, and clause. | SM&CR audit log |
| Deliver then delete | Cited answers delivered to the client. On exit, all client data in the deployment is deleted within 7 days. | Written deletion confirmation |
The compliance landscape VELA was built for.
VELA was designed to satisfy a specific regulatory intersection that cloud AI cannot address.
- UK GDPR Chapter V
- Cross-border transfer restriction.Bahamas, Cayman, BVI all lack ICO adequacy decisions. VELA eliminates the obligation — no data movement.
- FCA SM&CR
- Named accountability.Every AI governance decision must be traceable to a named Senior Manager. VELA's query log is a machine-generated SM&CR audit record.
- CIMA AML / Sanctions Rule
- Gazetted July 20, 2026. In force September 18, 2026.No grace period. VELA identifies gaps against this rule with exact document citations in under 60 seconds.
- CFATF 5th Round
- Caribbean mutual evaluations accelerating.VELA generates version-controlled, nightly-verified governance documentation that satisfies CFATF evaluator evidence requirements.
- NIST AI RMF
- 119 entries, 19 automated gates, ERRORS 0 WARNINGS 0.Maps to GOVERN, MAP, MEASURE, and MANAGE functions.
- ISO/IEC 42001
- International AI management system standard (2023).Framework mapping in development. Target Q1 2027.
What is not yet in place, and when.
We name gaps publicly because an institutional buyer deserves to know the credential roadmap before they sign.
In Progress
- ICO registration
Roadmap
- ISO 27001 — Q3 2027
- SOC 2
- UK entity
- ISO/IEC 42001 mapping