Ownership and security
You decide what your AI can access and do.
Your dashboard and agents run in accounts you control. We agree their access, approval rules and operating responsibilities before connecting them to your business.
Your code, accounts and data stay with you.
Your delivered source, accounts and data remain under your control, subject to vendor licenses and your agreement. Handover includes access details, configuration and instructions for the supported workflows.
Vendor subscriptions and maintenance still need an owner. Those responsibilities are set out before the build.
Decide when agents can reply, refund or publish.
Reading an order, sending a reply, issuing a refund and publishing a campaign each need their own permissions. You choose which actions can run automatically and which need review.
We record those rules and where exceptions go. Permission to build the system does not grant permission for every action.
Test the permissions as well as the workflow.
Acceptance checks cover everyday tasks, access boundaries and what happens when something fails. One successful demo does not verify every exception.
Your team supplies current policies, accurate product and cost information, and feedback from the people using the system.
Know which data and providers your system uses.
We agree which business information and external services each workflow needs, along with access and operating responsibilities.
Reused code must not contain another client’s customer data, credentials or private business information. Tell us about specific data or security requirements before we scope the build.
What about GDPR and sensitive data?
The data, purposes, providers and processing locations determine the review needed. The parties must agree their responsibilities and any required data processing agreement before access to personal data. Regulated or particularly sensitive workflows need assessment before they enter scope.
Client-owned accounts or an EU hosting region alone do not establish GDPR compliance. Our privacy notice explains website enquiries; your engagement documents cover processing for your build.
Vulc does not hold security certifications. A provider’s certification covers its stated scope; it does not certify Vulc or the application built on that provider.
Describe your concern without sending passwords, API keys or customer records. We can arrange an appropriate way to share further information.
Keep your system after service ends.
Ongoing management is optional. If chosen, it can be ended with 14 calendar days’ notice before renewal. The delivered functionality stays in your accounts. Your business then needs to maintain the system and keep the relevant vendor services running.
Read the service and cancellation detailsTell us what your system needs to protect.
Share your requirements early so we can assess the access, providers and controls your build needs.