Documentation

Deploy, connect and assess.

How to install VecShield next to your vector stores, what it connects to, how it works and how to read its results.

Installation

VecShield is self-hosted. Deploy it with Docker, Kubernetes / Helm or Terraform, including air-gapped installs. Chunks, embeddings, findings and evidence stay in infrastructure you control.

pip install vecshield
pip install "vecshield[chroma]"
pip install "vecshield[chroma,nlp]"

Install only the connector extras you need. The optional nlp extra adds named-entity recognition for names and addresses; its model is English-only. The console uses the detection library, which can also run independently.

# Audit a local Chroma store
vecshield-platform audit \
  --connector chroma \
  --path ./chroma_data \
  --report out.html

# Run the console
vecshield-platform serve \
  --config ./vecshield.json \
  --state-dir ./state \
  --port 8088

Installation and usage in the repository →

Architecture

Connectors read collections, configuration and access settings from your vector stores. Optional monitoring records retrieval events. Detectors turn both into findings for data exposure, RAG integrity and access posture.

VecShield runs in your environment and does not require sending vector-store contents to a VecShield-hosted service. Scans run against the store on their own schedule, not between your application and its queries.

Every result states what was scanned, what was sampled and what was skipped, and a sampled collection is reported as partial. Findings keep chunk ids and a masked preview, not the chunk text.

VecShieldInside your environment

Vector stores

Connectors

Read-only inspection

Retrieval events

Monitoring

Optional event capture

Detectors

Data exposure · RAG integrity · access posture

Findings & evidence

Coverage, masked previews and audit records

Supported stores

Each connector documents what it can read and which fixes it can apply.

Chroma
pgvector
Pinecone
Qdrant
Weaviate
Milvus
Redis
OpenSearch
MongoDB
OpenAI vector store
Azure AI Search
Amazon Bedrock Knowledge Bases
Vertex AI

Assessment and evidence

Five assessment engines, each aligned with the OWASP Top 10 for LLM Applications (2025) risks that apply to the retrieval layer.

Engine	What it checks	OWASP LLM risk
Scan	PII, PHI, payment data and credentials stored in chunks and metadata.	LLM02 Sensitive Information Disclosure
Integrity	Stored prompt injection, poisoned or unprovenanced content, duplicates and embedding anomalies.	LLM01 Prompt Injection · LLM04 Data and Model Poisoning
Access	RBAC drift, over-privileged or stale API keys, and cross-tenant retrieval probing.	LLM08 Vector and Embedding Weaknesses
Posture	Network exposure, TLS, observable encryption settings and known CVEs in the store.	LLM03 Supply Chain · LLM08
Compliance	Policy evaluation, allow-lists, obligation mapping and exportable evidence.	Supports GDPR, HIPAA, PCI-DSS, CCPA / CPRA review

In the console you register stores, run or schedule scans, review coverage, work findings as cases and export evidence. Remediations (label, tag, redact, quarantine, or move a tenant into its own collection) follow a four-step flow: staged, approved by a second person, executed, then read back to confirm.

The console also supports subject-access and erasure workflows. Authorised red-teaming engagements against the retrieval layer are described on the red teaming page.

Coverage and detection limits

Content that was not read is never reported as clean. Command-line assessments use these exit codes, so CI pipelines can gate on them:

0: the store was read in full and there are no high or critical findings.
1: the assessment could not run.
2: at least one high or critical finding.
3: coverage was incomplete. This is not a pass.

Cloud KMS, volume encryption and IAM may not be visible through a store connector. Unobservable controls are reported as unknown, not passed. VecShield is not a cloud posture scanner, and detection does not establish legal compliance.

Detection limitations by regulation →

Security model

No telemetry, masked values by default, and no writes to your stores while safe mode is on. Raw values require the compliance role and a stated reason, and each reveal is logged. Read the security model →

Contributing

VecShield is open source under Apache-2.0. Issues and pull requests are welcome. Read the contribution guidelines →