Security
Last updated 29 October 2026
Veqctor is built so that a bank never has to hand over code, data or positions. This page says exactly what stays with you, what leaves your browser, and where it goes.
At a glance
| Part of Veqctor | What leaves your browser | Where it goes |
|---|---|---|
| Model map and roadmap, including your institution's statuses | Nothing | Statuses are saved in your browser's local storage, on your device only. |
| Model library (validated kits) | Nothing about you | You download a zip of Python code, reference values and documentation. It runs on your own machines and makes no network calls. |
| Technology mapping and Resources | Nothing | Static pages. |
| Launch Veqctor (AI advisor) | Your intake answers and your messages | Sent to Anthropic's Claude API to generate the answers. With your consent, stored for 12 months to improve the tool (privacy notice). |
What we never ask for
- Code, data or positions. Nothing in Veqctor needs them. The kits come to you; your models never come to us.
- Names. Not yours, not your employer's, not your clients'.
- Quantum hardware access keys. When Veqctor links to cloud quantum hardware, you will use your own account; we will never hold your keys.
- Passwords. There are no user accounts today.
The AI advisor
Launch Veqctor is the only part of the site that sends what you type to a server. The advisor is instructed never to ask for proprietary code, data, positions or client names, and to steer the conversation back to a generic level if you start sharing them. Please do not paste confidential information.
Answers are generated through Anthropic's commercial API, under which API data is not used to train models by default and is kept only for a limited period. Conversations are stored only if you consent, for 12 months, and you can have yours deleted at any time with the session reference shown on the advisor page. To limit abuse, daily message caps use a one-way hash of your IP address, kept about 25 hours; the address itself is never stored.
Hosting and transport
- The site and its server functions are hosted by Vercel. Every connection is encrypted (HTTPS).
- Pages are served with security headers: they cannot be framed by another site, content types are enforced, and referrer information is limited.
- No cookies, no trackers, no analytics.
- Advisor sessions are stored in an Upstash database. Access is restricted to the publisher; credentials live in the hosting configuration, never in the code.
- Two third-party resources are loaded by your browser, as with any website using them: fonts from Google Fonts, and the open-source three.js library (for the 3D views) from the jsDelivr network.
Validation kits
Each kit is plain, readable Python that depends only on numpy and scipy (pytest for the tests). QuantLib reference values are computed once by us and shipped as JSON files, so QuantLib does not need to be installed. The kits contain no telemetry and no network calls. Review them as you would any third-party code before using them in your environment.
What Veqctor does not have yet
Veqctor has no security certification (such as ISO 27001 or SOC 2), no single sign-on or user accounts, no contractual hosting region and no independent penetration test. We intend to put these in place with the first institutions that need them.
Report a vulnerability
If you find a security issue, write to romaind@phalanx-capital.eu. We will acknowledge your report and keep you informed of the fix.
Publisher
Veqctor is published by Phalanx Capital, 60 rue François Ier, 75008 Paris, France.