Security & Compliance Console
The Security & Compliance Console runs in your environment. It registers your vector stores, scans what's inside them, tracks each finding as a case, applies fixes after approval, and exports evidence that says what was examined as well as what was found.
Register each store with its connector, owner and environment. Network discovery can find instances nobody registered.
Scan collections for personal, health, payment and credential data, on demand or on a schedule, and record how much of each was read.
A finding becomes a case with an owner and a decision. Closing it needs a reason; marking it verified needs a later scan.
Fixes are staged, approved by a second person, executed and read back. Safe mode blocks all writes until turned off.
An export that states who concluded what, over which stores, for which period, and what remained open.
Connects to Chroma, pgvector, Pinecone, Qdrant, Weaviate, Milvus, Redis, OpenSearch, MongoDB, OpenAI vector stores, Azure AI Search, Amazon Bedrock Knowledge Bases and Vertex AI. The Schema Explorer shows each collection's metadata fields, types and how often each is filled.
Detects personal data, health information, cardholder data and credentials in chunk text. Collections that were sampled or not scanned are listed as such instead of being reported as clean.
Checks network exposure, TLS, encryption at rest where the store exposes it, and dependency CVEs. Compares granted access with intended access, flags stale or over-privileged API keys, and probes for cross-tenant retrieval.
Finds prompt-injection text, chunks without provenance and anomalous embeddings. Query monitoring, from replayed logs or a wrapper around your connector, alerts on bulk reads, enumeration and collection sweeps.
Finds a data subject's records across every registered store, runs erasure with a verification pass afterwards, and prepares the inputs for a GDPR Article 35 DPIA from what the scans found.
Label, tag, redact or quarantine chunks, assign a missing tenant, or split tenants into their own collections. Each change is staged, approved by a second person, executed and read back. Fixes no connector can make come as store-specific steps, checked by a re-scan.
Findings keep a masked preview, not the text. Raw values need the compliance role and a stated reason. Reveals, approvals and executions go into a hash-chained audit log.
Exports evidence mapped to GDPR, HIPAA, PCI-DSS, SOC 2, CCPA/CPRA and the EU AI Act. Deploys with Docker, Helm or Terraform, including air-gapped. API roles, JWT auth, health probes and Prometheus metrics are built in.
A 30-minute technical walkthrough of the console using the connectors you run.
