Security
Decision integrity
- Every underwrite and access decision is auditable and versioned.
- Prefer deterministic policy for synchronous authorization paths.
- AI assists investigation — it does not silently replace human-governed policy.
API hygiene
- Secret keys stay server-side (
sk_sandbox_…/ live prefixes as issued). - Scopes limit what each key can read or write.
- Idempotency keys on mutating financial and decision writes.
Webhooks
- HMAC-signed deliveries.
- Retry with backoff.
- Verify signatures before fulfilling.
Controls boundary
Vence can pause product access, unused credit, and contractually permitted card controls. Docs never claim Vence freezes arbitrary external assets outside that scope.Console
Institutional login (WorkOS). Role-based membership. Environment isolation between sandbox and live.Security & model-governance roadmap
Honest status for founder-beta. We do not claim SOC 2, regulatory licenses, or production compliance certifications today.Available in sandbox (Decision Platform)
Encryption & access control
Model governance
When evaluating Vence, treat sandbox controls as the verifiable baseline. Production enablement, certifications, and licensed program claims land only when evidence exists — not before.