Credentials and Certifications
SOC 2 Type I
AICPA Trust Services Criteria
Growth Acceleration Partners, the company behind GAPVelocity AI, has completed an independent audit and received a SOC 2 Type I report. The report confirms that our security controls are designed appropriately and supported by evidence.
- Report
- SOC 2 Type I
- Scope
- GAP Engineering Business Unit
- Access
- Available on request, under NDA
Microsoft Solutions Partner
Designated for Digital & App Innovation on Azure. Microsoft grants this designation to partners who demonstrate certified skills and customer success building and modernizing applications on Azure.
How VELO Is Secured on Microsoft Azure
VELO separates public access, application logic, customer data, and AI execution into distinct layers. Users reach VELO through Azure Front Door and upload files to Azure Blob Storage; the application services and databases run on private Azure networking.
Your TeamSigns in through a browser
Microsoft AzureVELO's Azure environmentEdge and Web Frontend
Azure Front DoorWeb application firewall, rate limiting, Azure platform DDoS protection
VELO Web ApplicationAzure Container AppsApplication Layer
AI and Modernization
Microsoft FoundryAgents and model accessSecure Upload and Scanning
Isolated Upload StorageAzure Blob StorageProcessing StorageCompany-scoped, scanned files onlyData Layer
Azure SQL DatabaseApplication data and resultsIdentity, Secrets, and Operations
Microsoft Entra IDUser sign-in
Azure Key VaultSecrets and keys
Azure MonitorCentralized logging
Application InsightsTelemetry and observabilityControlled Entry Point
Users reach VELO through Azure Front Door. The VELO API and databases are not exposed directly to the internet.
Customer Separation
Every customer gets its own company workspace. Files are stored under company-specific paths, and the application limits each user to their own company's projects.
Secure Ingestion
Every upload lands in isolated storage and is scanned for malware. Only files that pass are moved to the storage VELO processes from.
Protected AI Execution
VELO's AI agents use models deployed in VELO's own Microsoft Foundry resources, including Anthropic Claude. VELO does not call outside model APIs directly.
Controlled Identity
Microsoft Entra ID handles user sign-in, and Azure Key Vault holds application secrets and keys outside application code.
Defense in Depth
A web application firewall, rate limiting, user sign-in controls, encryption, malware scanning, private endpoints, and centralized logging work together so no single control carries the load.
What We Commit to in Writing
These commitments come straight from the VELO Terms of Use, so they hold up in procurement and security review.
You Own the Code
You keep full ownership of the source you upload and the modernized code VELO returns.
Terms §3.2No Model Training on Your Code
Your source code, intellectual property, and data are siloed and never used to train any AI model.
Terms §3.3Deletion Within 60 Days
When your agreement ends, or earlier if you ask in writing, we delete your original and modernized code from the portal within 60 days.
Terms §3.5Screened Before Processing
Uploads are checked for malware and harmful content. Anything rejected before processing does not count against your line-of-code allocation.
Terms §2.4VELO Terms of Use at a Glance
A plain-language summary of the provisions security and legal teams ask about most. The full Terms of Use govern in every case.
| Section | Topic | What it means for you |
|---|---|---|
| §2.1 | Service scope | You upload source code to a dedicated VELO portal. We screen it, modernize it, and return the modernized code through the portal for your review. |
| §2.2 | Capacity | Licenses are fixed-price allocations of lines of code or processing tokens. Processing pauses when the allocation is used up. |
| §2.4 | Security screening | All uploads are scanned. Please remove passwords, API keys, and other credentials before you upload. |
| §3.2 | Ownership | Your original application and the modernized application belong to you. |
| §3.3 | No model training | Your code is never used to train AI models. General process improvements never contain or reveal your code. |
| §3.4 | Usage data | We collect product usage data, such as features used and project sizes, to improve VELO and confirm license compliance. |
| §3.5 | Retention | Code is deleted from the portal within 60 days of termination or written request, apart from legally required copies and routine backups. |
| §4 | AI output review | VELO runs on Microsoft Foundry. Your team reviews and tests modernized code before deploying it to any environment. |
| §11 | Governing law | Texas law, with venue in Travis County, Texas. |
To request the full Terms of Use, email us at info@wearegap.com.
Security Practices Behind the Platform
Risk Management
We run a risk assessment every year and whenever the organization or its systems change significantly. It covers security, fraud, legal and regulatory, and third-party risk.
Employee Training
Every GAP employee completes mandatory annual security awareness training, including how to report incidents and role-specific guidance on handling sensitive data.
Third-Party Security
Critical service providers are reviewed at least once a year, more often based on risk. We update their risk profiles and review their SOC 2 reports where available.
Human Review of AI Output
Our engineers treat AI as a collaborator. Code produced with AI goes through human review before delivery.
Report a Security Concern
If you suspect a security incident involving VELO, or you find a vulnerability in the platform, contact our security team directly. Reports go to people who can act on them, and we keep you informed until the issue is closed.
Contact Us
security@wearegap.com
For an urgent issue affecting your account or code, also notify your GAPVelocity AI account team.
Include in your report- Your name, company, and VELO account
- What you observed and when
- Affected projects, uploads, or URLs
- Steps to reproduce, if you are reporting a vulnerability
- How we can reach you
Never send passwords, keys, or source code in your report. We will arrange a secure channel if we need them.
- We Confirm Receipt
The security team acknowledges your report and gives you a point of contact.
- We Assess the Impact
We investigate, determine severity, and identify any affected customers, data, or services.
- We Contain and Fix
We take steps to contain the issue and remediate it, including suspending affected access where needed.
- We Keep You Updated
You receive status updates while the issue is open. Customers whose data is affected are notified within 48 hours of confirming the incident.
- We Close It Out
We confirm resolution and share a summary of what happened and what changed.
Reporting a vulnerability? Please act in good faith: don't access, change, or delete data that isn't yours, don't disrupt the service, and give us reasonable time to fix the issue before sharing it publicly.
Security Review FAQ
Where does my code go when I upload it?
Into isolated upload storage in Azure Blob Storage. Files are scanned for malware, and only files that pass are moved to the storage VELO processes from, under your company's path.
Does my code leave Microsoft Azure for AI processing?
VELO reaches Anthropic Claude models through Microsoft Foundry. For some models, prompts and outputs are processed on Anthropic's infrastructure under Anthropic's data processing terms.
Is my code used to train AI models?
No. Section 3.3 of the Terms of Use commits us to siloing your data and never using your source code, intellectual property, or customer data to train any AI model.
Who owns the modernized code?
You do. Section 3.2 of the Terms of Use confirms you keep all ownership rights to both the code you upload and the modernized code VELO produces.
How do I get a copy of the SOC 2 report?
Request it through the GAP security and compliance page. Our team shares the report under NDA.
What should I remove before uploading?
Remove passwords, API keys, connection strings, and other secrets from your source before upload. Our scanning protects the service, and it is not a security audit of your application.
Know Before You Commit
VELO gives you a fixed price and a defined outcome at each stage of your modernization, so you can make a clear investment decision before the next commitment.
