What matters goes through a person. And it's on record.

• Your data trains no models

  Not ours, not anyone else's.

• Every company, isolated

  With its own encryption key.

• What matters goes through a person

  Paying, filing, hiring and signing, always.

• The agent never sees your credentials

  No passwords, tokens or bank signatures.

• Everything is on record

  In a chained log that cannot be altered.

• You keep everything

  Roles, skills, tests and records in open formats.

1. 01

   What you approve is exactly what goes out. If anything changes, it asks again.

2. 02

   Two approvals above an amount, for a new supplier or for personal data.

3. 03

   Whoever asks cannot approve. The agent never approves its own work.

4. 04

   The agent never sees passwords, tokens or anyone's bank signature.

5. 05

   Daily limits: amount, recipients and outside messages.

6. 06

   Every outside message waits 2 minutes, with an Undo button.

7. 07

   Memory filters by who may see it, before anything reaches the model.

8. 08

   National IDs, bank accounts and payroll, encrypted and kept out of context without permission.

9. 09

   A chained audit trail that cannot be altered and can be exported.

10. 10

    Shadow mode before an agent gets more autonomy.

11. 11

    A kill switch per agent and per company.

EncryptionBeta

TLS 1.2 or higher in transit and AES-256 at rest. Sensitive fields get a second layer of encryption with your company's key.

IsolationBeta

Every database query is filtered by company with row-level policies. An automated test tries to cross companies in every release.

Retention

Audio, 30 days. Transcripts, 12 months. Audit trail, 5 years. Your company can agree on different terms.

Deletion

When the contract ends we hand over your Exit Kit and delete your data within 30 days, except what the law requires us to keep.

BackupsBeta

Daily and encrypted, with point-in-time restore and restore drills every quarter.

Location

Data and model traffic are processed in the US or in the provider's global region. We do not offer in-country processing in Peru.

No training

We use models through enterprise APIs that do not train on what is sent. We do not train models on your data either.

Uploads are information, not orders

An email or a PDF may try to give the agent instructions. The agent treats it as quoted text and never changes its rules because of it.

Code decides permissions

Before every action, the system computes what the agent may do. The model proposes; it does not decide what it is allowed to do.

Tests before every change

Each agent has its own set of real cases. A change of rules or model that makes results worse does not ship.

It always says it is AI

In the first message, in its profile and in every signature. It never passes itself off as a person.

Decisions about people

Hiring, reviewing, disciplining or dismissing is always decided by a person. The agent prepares the information.

Roles per companyBeta

Admin, agent owner, approver and user. Each sees only what the role allows.

Two-factor authenticationBeta

To sign in on the web and to approve sensitive actions.

Sign-in with your directoryComing soon

Google or Microsoft. Offboarding in your directory cuts access here.

Our teamBeta

Accesses your company's data only with your support request, for a limited time and with a log you can see.

Managed providers

Database, hosting and models run on providers that maintain their own certifications. Those certifications are theirs, not ours.

Separate environments

Development and production are kept apart. Customer data never leaves production.

Checks on every change

Every code change goes through automated secret scanning and a dependency review before it ships.

Monitoring

Alerts on errors, unusual access and unusual consumption by each agent.

• Isolation between companies, tested in every releaseBeta
• Official WhatsApp API, on your company's numberBeta
• Encryption in transit and at rest; keys per companyBeta
• Models that do not train on your dataBeta
• Information security policyBeta
• Data processing agreement (Peru Law 29733)Coming soon
• External penetration tests, with a summary for customersComing soon
• SOC 2 Type 1Coming soon

Current as of October 23, 2026. Google and Microsoft are added only if you connect your account. We give 30 days’ notice before adding a new subprocessor.

1. 01

   Contain

   We shut down the affected agent or connection within minutes, with the kill switch.

2. 02

   Notify you

   Within 72 hours at most: what happened, what data was involved and what we did.

3. 03

   Notify the authority

   Peru's National Personal Data Protection Authority, when the law requires it.

4. 04

   Learn

   A written report with the cause and the change that keeps it from happening again.

• Information security policy

  Beta

  How we protect data, access and changes.

• Security questionnaire

  Beta

  We answer your IT team's questionnaire or a standard one.

• Incident response plan

  Beta

  Who does what, on what timeline, and how we notify you.

• Subprocessor list

  Beta

  The current one, with 30 days’ notice before adding a new one.

• Data processing agreement

  Coming soon

  Under Peru Law 29733 and its regulations.

• Penetration test summary

  Coming soon

  Performed by an independent third party.

seguridad@vimdo.comPrivacy policy