Your data and code stay in your control
Every system runs on accounts your company owns. You can remove our access, and your data does not train AI models.
You own the system, the code and the data
Everything is set up in your company’s name and billed to you before any code is written. If we part ways, the system keeps running.
- Your accountsHosting and database accounts belong to your company and cost from about $100 a month at small scale, paid to the providers.
- Your codeThe code lives in your organization’s repository. There are no license fees.
- Your dataData stays in your database. We work in it with the access you grant.
- Access you can removeOur access is a user account you can switch off at any time.
Still running. Still yours.
Your data lives in your own accounts
Most systems use a Postgres database on Supabase and hosting on Vercel. You choose the database region at setup, such as the EU or the US.
| Part of the system | Where it lives | Who controls it |
|---|---|---|
| Code | A repository in your organization’s account | You. We work in it with access you grant. |
| Database and files | A Postgres database (Supabase) in your account, in the region chosen at setup | You. |
| Hosting | A Vercel project in your account, billed to your company | You. |
| Logins and admin rights | The system’s own user list, with roles you approve | You. Admin rights stay with you. |
| Tools you keep | Where they are today, such as your accounting system or CRM, connected to the new system | You, under your existing contracts. |
| AI requests | Sent to the model provider when a feature runs, under that provider’s business terms | You decide which features use AI. |
Most systems are web applications on a Postgres database (Supabase), hosted on Vercel, in accounts your company owns. Where HIPAA applies, we build on AWS or Google Cloud under a signed business associate agreement. Where NIST 800-171 or FedRAMP controls apply, we build on AWS GovCloud (US) or Google Cloud Assured Workloads.
Access is named, logged and yours to switch off
Each person, our engineers included, gets only the access their role needs. Switch off our accounts and the system keeps running.
- 01Accounts in your name
You own the accounts. We are invited as named users, and admin rights stay with you.
- 02Role-based, logged access
Each person sees only what their role needs, and access is logged.
- 03Your team, by role
Your staff get accounts by role, so the owner, the office and the field each see their own work.
- 04Our access removed
You switch off our accounts in one step. The system keeps running, and nothing has to be handed back.
Your data does not train AI models
We use AI providers’ business services, whose terms exclude your data from training by default. A person approves what AI drafts.
- No training on your dataClient data is never used to train a model, by us or, under their business terms, by the providers we use.
- Only what the task needsA feature sends the model the data for one task, such as one email to draft a reply, never your whole database.
- People approveA person approves what AI drafts until it has proven accurate. You decide when a task can run without review.
- Providers chosen task by taskAI features use models from providers such as OpenAI and Anthropic, chosen for each task and named in your agreement.
Today
- Job #2141 moved to ScheduledAutomatic
- Reply to Hartley & Co. draftedAI draftApproved by Sarah
- Invoice #881 sent with job photosAutomatic
- Weekly report ready for the ownerAutomatic
Owner pulled in, per week
31times a week, down from 31
You get an NDA as standard
Your data stays in accounts your company owns, and we only use it to build and run your system.
- NDASigned as standard, before you share anything confidential.
- Health dataIf you handle health data, raise it on the discovery call and we will go through your requirements.
Every provider is named before data moves
We tell you which providers your system uses before any data moves. Most systems use the ones below. Certifications shown are each provider’s own.
| Provider | What it does | Whose account | Provider’s own certification |
|---|---|---|---|
| Vercel | Hosts the application | Yours | SOC 2 Type 2. Vercel security |
| Supabase | Postgres database, file storage and logins | Yours | SOC 2 Type 2. Supabase security |
| OpenAI | AI models for selected features | Agreed for each project | SOC 2 Type 2. OpenAI trust portal |
| Anthropic | AI models for selected features | Agreed for each project | SOC 2 Type 2. Anthropic trust center |
| Tools you keep | Existing tools, such as your accounting software, that the system connects to | Yours, under your existing contract | Set by each provider |
Certifications are the providers’ own, as published on their security pages. Verticulate holds no certification of its own.
Six security practices on every build
No practice makes a system immune to attack. Together they make problems less likely and quicker to find and fix.
- Named accounts, least accessEveryone has their own login with only the access their role needs. Nobody shares a password.
- Encrypted connectionsSystems are served over HTTPS, and the hosting and database providers encrypt the data they store.
- Logs and alertsAccess is logged. Integrations record what they do and alert us when they fail.
- Every change trackedCode changes are recorded in your repository, so you can see who changed what, and when.
- Secrets out of the codePasswords and API keys sit in the hosting provider’s protected settings, not in the code.
- Backups you controlDatabase backups run through the provider, on a plan in your account.
Security questions get a straight answer
Architecture, integration and security questions are welcome on the discovery call.
Found a vulnerability in a system we built or in this website? Tell us before you share it, using the contact details in our imprint, and we will work with you to fix it.
Mostly, yes. We keep the tools that work, connect the ones that hold data you need, and replace spreadsheets and boards nobody updates. We confirm the verdict for each tool during the diagnostic, so nothing is switched off without a reason.
You do. The accounts, hosting, database and code are in your company's name from day one and billed to you directly, usually from about $100 a month. Our access is one user account you can switch off at any time. There are no license fees.
Most systems are web applications on a Postgres database (Supabase), hosted on Vercel, in accounts your company owns. Where HIPAA applies, we build on AWS or Google Cloud under a signed business associate agreement. Where NIST 800-171 or FedRAMP controls apply, we build on AWS GovCloud (US) or Google Cloud Assured Workloads.
We sign NDAs as standard. Access is role-based and logged. If you handle health data, raise it on the discovery call and we will go through your requirements.
Trusted by 100+ companies, including
- 6 figuresimpact on the bottom line
- 14 → 2people needed on one delivery team
- +40%revenue per employee, within 6 months
- 33% lowerproject completion time, from inquiry to completion
- 14 hours a weektime saved on B2B inquiries and quotes
- 40 hours a monthtime saved on client onboarding
- 1x → 6–7xpersonalized outreach capacity
- New CRMwith internal processes automated
- 1 hour → Secondsmanual work to onboard a new client
- End to endlead research and qualification automated