Your servers. Your data. Every action on the record.

How VEGA is built and operated · how to report a vulnerability

VEGA is made for organisations whose work and data must stay under their own control. The security model follows from that: VEGA runs where you decide, authenticates against your identity provider, and keeps a record of everything that happens in it — including what AI did.

Where VEGA runs

• Self-hosted. Every component — application services, PostgreSQL, message bus, file storage, identity integration — runs on Linux servers you control, on-premises or in your own cloud account.
• One command to install. Secrets are generated at installation; nothing ships with a default password.
• No outbound telemetry. VEGA sends nothing to us. The licence works offline.
• Updates when you choose. Releases are signed; you apply them on your own schedule.

Identity and access

• Sign-in through your identity provider over OpenID Connect; VEGA keeps no passwords of its own when an identity provider is connected.
• Access is granted per project, product or team through roles with defined capabilities. Stakeholders see a curated view maintained by the project manager, never the whole system.
• Every user action is written to an immutable audit history.

Data protection

• Data lives in your PostgreSQL and your file storage. File storage is encrypted; internal connections use TLS.
• Deletion is secure: deleted records and files are removed, not hidden.
• Backups follow your own database and storage backup procedures; the administrator guide lists what to include.

Supply chain

• Container images are signed and ship with a software bill of materials (SBOM), so you can verify what you run and check it against vulnerability databases yourself.
• Third-party components are kept current; security fixes are released as patch versions.

AI, under your control

• AI is optional and enabled per module, project or person. VEGA is complete without it.
• The provider is a configuration setting: the major providers in their EU regions, or a model on your own hardware for isolated environments. No data leaves your servers unless you configure a provider.
• Every AI call is logged with the user, the model, tokens and cost. Prompt text is not stored.
• AI-written text stays visibly marked until a person approves it. Agents follow the same rules, reviews and gates as people.

Independent testing

An independent penetration test report is available to prospective customers under NDA. Ask for it at info@vegaspace.io.

Reporting a vulnerability

This website

vegaspace.io is served over HTTPS only, loads no third-party scripts, sets no cookies and uses no analytics. See the privacy policy for details.