Virtum

Trust and security

Real systems. Real control.

Virtum lets AI work on real systems, so the controls are not an add-on. Every model call, from any feature, goes through one gateway, and every action goes through the same approval and audit path.

01

One gateway for every model call

Every feature goes through the same controls.

  • Your admins choose which models, providers and regions your workspace may use
  • A call with no cleared model is refused, never quietly sent elsewhere
  • Monthly budgets and per-model ceilings checked before every call
  • Your own provider key means you pay the provider directly

02

Redaction

Recognised sensitive data is removed before a model sees it.

  • Card numbers, IBANs, national insurance and social security numbers replaced before sending
  • Secrets such as API keys, tokens and private keys removed, including full PEM blocks
  • The same redaction applied to what comes back, even mid-stream
  • Email addresses and phone numbers can be redacted too

03

Prompt-injection defence

Content is treated as data, not instructions.

  • Questions, retrieved documents, tool output and attachments scanned for injection attempts
  • Disguised attempts caught: invisible characters and look-alike letters
  • Record detections, or block the call, as your workspace chooses
  • Retrieved content always passed to the model as reference data

04

Access and isolation

Your workspace is yours alone.

  • Every conversation, index, memory and record belongs to one workspace
  • Automated tests check AI endpoints refuse access across workspaces
  • The assistant can only do what the person using it is allowed to do
  • Only the owner of a conversation can read or continue it

05

Actions and approvals

Changes run only within the approval rules you set.

  • Reading and investigating happen without asking
  • Anything that changes your estate is proposed and waits for approval, unless you let low-risk actions run
  • Bypass mode applies to one conversation, expires, and is shown while on
  • Destructive actions always ask, whatever the setting
  • Every approved action is recorded with who or what approved it

06

Audit

Everything on the record.

  • Every model call recorded: who, feature, model, provider, region, tokens, cost, outcome
  • Every redaction, detection and refusal on your AI control ledger
  • Key links and data exports on a tamper-evident, hash-chained ledger
  • A linked key only ever shown by its last four characters

07

Coding sessions

AI coding in a sealed box.

  • A separate sandbox for every session, with no route out but the model provider
  • Short-lived repository credentials, never inside the sandbox
  • Changes proposed as a branch and draft pull request; Virtum never merges
  • A change that adds a credential is blocked

08

Your data, your controls

Export it, delete it, decide how long it stays.

  • Owners and admins export all of a workspace's AI data as one file
  • Delete it, with a preview first
  • Every person can see, export and delete their own AI data
  • Set your own retention, shorter than the default
  • Prompt and response content removed after 90 days by default
  • Everything stored in the deployment's region, scoped to your workspace

Your data

Where your data lives, and how it is looked after.

The same facts our privacy notice and data processing terms commit to.

  • Hosted in the UK

    The Virtum platform, its databases and its backups run on servers Virtum operates in the UK.

  • Encrypted in transit

    Between your browser and our servers, including the link between our network edge and our servers.

  • Backed up and restore-tested

    Nightly backups kept 14 days in the UK, with an encrypted copy in AWS's London region, and restores tested every week.

  • Sub-processors, in public

    Every third party that handles personal data for us, what it does and where, with 30 days' notice before we add one.

  • Data processing terms

    How we process your organisation's data on its behalf, under UK GDPR Article 28.

  • Live service status

    How Virtum's services are running right now, with incidents and planned maintenance.

Who we are

Virtum Cloud Ltd

Virtum Cloud Ltd, registered in England and Wales, company number 17239759. Registered office: 38 Beechfield House, Macclesfield, Cheshire, SK11 0LP, United Kingdom.

Found a security issue? Email security@virtum.cloud (also in our security.txt). Questions about personal data go to privacy@virtum.cloud; see our privacy notice.