How VeLens handles your data
The AI sees Marketing Cloud metadata, never subscriber data, and nothing is written to your account without your approval.
Full detail is in the Privacy Policy, the Terms and the Data Processing Addendum.
The controls
Your package, your control
Access flows through your org's own Installed Package OAuth. You grant it, and you revoke it from Marketing Cloud Setup, under Apps then Installed Packages. Revoking stops all new access at once. A token already issued expires within 20 minutes.
Credentials never touch the browser
Refresh tokens are held server-side and encrypted at rest. The browser only ever receives a short-lived token scoped to the one business unit you are working in.
Subscriber data stays home
No subscriber rows, contact details or attribute values reach the model. Schemas, counts, headers and errors only.
Nothing changes without a confirm
Writes propose first. Nothing changes in your org until someone confirms, and what runs is the exact tool that was proposed, with the exact arguments shown. An email edit can be restored for seven days, and a create says up front that it cannot be undone from VeLens.
A full audit trail
Every tool call and every confirmed write is recorded: who asked, what ran and what it ran on. On the Activity page in the web app, owners and admins see the whole org's trail and every other member sees their own. Entries are kept for 30 days.
Zero-data-retention AI routing
Model calls run through a gateway with zero data retention enabled, configured to fail closed. If a zero-retention route is not available the request errors out. There is no silent fallback to another provider.
Business-unit scoping
Answers stay inside the business unit you are working in. Every request is checked against the business units your connection is actually allowed to reach.
Roles and feature toggles
Admins decide which capabilities the org can use, and what the AI may read or write. Set it org-wide or per role. Switch a capability off and it disappears for everyone, on every surface.
One capability is a disclosed exception, and it stays off until an org admin turns it on. The AI can check a single subscriber's engagement history, looked up by a key the user types in. It returns email, journey and list names, dates and statuses only, and the identifier itself is masked in everything sent to the model.
What we don't claim
We do not hold a SOC 2 report or an ISO 27001 certificate.
Sub-processors
These are the companies that process data on our behalf. The full table, with exactly what each one receives, is in the Privacy Policy.
| Sub-processor | Purpose |
|---|---|
| Vercel, Inc. | Hosts the VeLens web app and API |
| Supabase, Inc. | Database and authentication, including the encrypted Marketing Cloud tokens, conversation history and audit log |
| Cloudflare, Inc. | Stores the twice-daily backups, encrypted before they are sent, with no key held by Cloudflare |
| GitHub, Inc. | Runs the scheduled backup job, which encrypts each backup before upload. The key that decrypts the backups is not stored on GitHub |
| Salesforce, Inc. | VeLens' own Sales Cloud and Marketing Cloud accounts, holding our customer records and the emails we send you. No data from your tenant, your conversations or your tokens |
| Vercel, Inc. (AI Gateway) | Routes model calls, with zero data retention enabled and configured to fail closed |
| OpenAI, Inc.; Anthropic, PBC; Google LLC (Google Cloud); Microsoft Corporation (Azure); Amazon Web Services, Inc. (Amazon Bedrock) | Run the OpenAI, Anthropic and Google models reached through the gateway, with zero data retention. The gateway picks the provider for each request |
We update this list and give notice through the product or by email at least 30 days before we add or replace a sub-processor, as set out in the Data Processing Addendum.
Questions from your security team
Send them over and we will answer in writing. Vulnerability reports go to security@velens.cloud.