Security you can check.
What is in place is stated plainly. What is not yet in place is marked as planned. We only call something certified once it is.
Where data lives and who can see it.
Data is stored in Frankfurt (eu-central-1).
Each customer's data is separated by row-level security in the database.
The first dispute to any carrier always waits for a person.
VaernFlow reads, checks and drafts. You approve. These are the controls that sit between a finding and a carrier.
How review works
- First dispute always waits. The first dispute to any carrier is held until you approve it.
- Auto-send is gated. Where it is used, it depends on the confidence of the finding, a hold window before sending, and an amount cap.
- One click. Approve or reject from a link in your inbox, or from the review queue.
- Findings quote their source. A finding that cannot quote a line from your documents is dropped.
- Arithmetic is rechecked by code. Amounts are re-added outside the AI model, and a finding whose numbers do not add up is dropped.
- Currency mismatch forces review. If the currencies do not match, a person has to look before anything moves on.
Certifications we do not hold yet.
We are not certified under either standard today. They are listed so you know where we are heading.
Planned. Not certified yet.
Planned. Not certified yet.
Three steps, nothing hidden.
This is the full path of a document today.
You send it
You upload a file, forward an email or connect Gmail.
An AI model reads it
The document is sent to an AI model provider through an API, so it can be extracted and audited.
It is stored in the EU
Documents and results are stored in our database in Frankfurt (eu-central-1).
That is everything this page claims about data flow. If you need more detail, ask us at hello@vaernflow.com and read the DPA.
Questions from your security team?
Read the data processing agreement, or write to us. We will answer what we know and say so when we do not.