Vic.ai Trust Center

Vic.ai holds SOC 1 Type II and SOC 2 Type II certifications, renewed annually and audited by third-party assessors. These certifications validate our internal controls and security practices for protecting customer data. Vic.ai also follows an ISO 27001 framework.

Vic.ai is hosted on Amazon Web Services (AWS), leveraging its secure, highly available, and globally recognized cloud infrastructure. Customer data is processed and stored within AWS regions aligned to the customer’s deployment requirements, ensuring strong physical and network security controls.

AWS provides built-in redundancy, encrypted storage services (including Amazon S3 and PostgreSQL-backed databases), and multiple Availability Zones for resilience and failover. Vic.ai’s use of AWS also enables continuous monitoring, automated scaling, and robust disaster-recovery capabilities as part of our SOC 2 Type II-validated controls.

All data entering or leaving the Vic.ai platform is encrypted using HTTPS/TLS with the strongest available libraries, including SHA-256 and modern TLS standards.

Data at rest is encrypted using AES-256 and FIPS-validated encryption at the storage layer. Encryption keys are regularly rotated.

Yes. Vic.ai supports SSO via Auth0. MFA is supported when enabled through the customer’s identity provider.

Vic.ai follows least-privileged access, role-based permissions, short-lived access tokens, encrypted VPN for elevated access, and continuous audit logging through AWS CloudTrail. Internal access is strictly limited and monitored.

All data ingestion methods (email, SFTP, API, mobile upload) require encrypted transport. Invoice images, metadata, and model outputs remain encrypted throughout extraction and processing. No unencrypted protocols (e.g., HTTP) are permitted.

Yes. Vic.ai engages an independent third-party security firm to perform annual penetration tests on the platform. Findings are reviewed by our engineering and security teams, and any identified issues are remediated according to severity. Penetration testing is also a control area validated through our SOC 2 Type II audits.

Data is retained for the duration of the customer agreement and only as needed for operational, legal, and audit purposes. Customers may request data deletion or export at any time; requests are processed promptly by the Vic.ai support team.

Vic.ai utilizes two distinct types of models to make predictions on an invoice, each with a different training methodology.

Global AI models: This model is used to make predictions on invoice header-level fields (fields that are not unique to you), such as invoice number, invoice date, due date, total amount, and currency. For this model, we train the model using derived data, so all customers benefit from more accurate predictions. The derived data is always a derivative of the data at scale, and does not contain identifiable data. An example of this is the specific coordinates and/or location of an invoice number on an invoice.

Local AI models: This model is used to make predictions on invoice line-level coding (fields that are unique to you), such as GL account coding, location, and department. This model is trained using customer materials, and learning is not shared across clients.

Vic.ai leverages AWS Availability Zones for redundancy and maintains an audited Disaster Recovery plan as part of SOC 2 compliance. Data stored in S3 is automatically replicated across multiple regions. Vic.ai has historically achieved 99.9%+ uptime. Testing and validation occur regularly at a minimum of once a year, with remediation steps tracked and documented.

All incidents are logged centrally and addressed according to priority-level SLAs:

Critical: 4 hours
High Priority: 48 hours
Medium: Next release
Low: Next planned cycle

Vic.ai uses AWS GuardDuty for threat detection and AWS Security Hub for continuous security posture management.

SOC 1/SOC 2 reports are available under NDA and can be requested through your Vic.ai representative or the document form below. Other documents (e.g., security policies, data protection policies) are available below.

Vic.ai does not process payment card information directly and is therefore not in scope for PCI DSS compliance. If PCI-adjacent processes are introduced, applicable controls will be implemented accordingly.

Vic.ai provides ongoing support, maintenance, and monitoring to ensure secure and reliable platform performance. Updates, enhancements, and security patches are deployed regularly through our cloud-based architecture.

Technical support is available for issue resolution and troubleshooting, and all incidents follow defined SLAs — with critical issues addressed immediately and lower-severity items handled in scheduled releases. Continuous monitoring, automated scaling, and disaster-recovery readiness are maintained as part of our SOC 2 Type II controls.