Security and compliance, answered up front.

01

Data residency

Vera is deployed in your sandbox, private cloud or on-premise, on the model you approve. It can be deployed in Switzerland, Singapore, the EU and other jurisdictions. The Ledger256 record runs inside your organisation and is timestamped by a qualified timestamp authority (ZertES or eIDAS).

This website is hosted separately and holds no client data.

02

Data handling

• Client data, documents, prompts and outputs stay in your systems
• Read-only access to your data during the pilot
• Client data is never used to train AI models
• Data is deleted under your own retention rules
• ICON keeps no copy of your records; anything we hold for support is deleted at the end of the contract, as you instruct

03

Access control

We agree the access model with each client before a pilot starts: on-site, through your own remote access, or both. Every deployment has a named owner and reaches only the systems its task needs, and all access runs under your logging.

Every Vera agent has Perimeter built in. It controls what the AI can see: deny by default, scoped to the case, never more than the user’s own entitlements, fenced by booking centre, with field-level redaction. It is enforced in the data access layer, and every access, including refusals, is recorded by Ledger256.

04

Security testing

You can run your own penetration test of the pilot environment, and we support your security team through it.

05

Incident response

If we become aware of a security incident affecting your data or your deployment, we notify you within 24 hours.

Security contact: office@icon-worldwide.com

06

Contracts

• Data processing agreement on request, under the Swiss FADP and the EU GDPR
• Service level agreement with every client
• ICON Worldwide AG is a Swiss company, registered in the Commercial Register of the Canton of Zürich (UID CHE-102.473.309)

07

Certification roadmap

ISO/IEC 27001 (information security) and ISO/IEC 42001 (AI management) are planned for 2027.

08

Regulatory alignment

Vera is designed for the expectations in FINMA Guidance 08/2024, the MAS Guidelines on AI Risk Management and EU AMLR Article 76. See the regulatory timeline →