Vindex
Sign in

Security, data and AI

A verification service holds some of the most sensitive information a person or a company has. This page sets out who can see it, how every action is recorded, where AI is used and where it is not, and the rights you keep over your data.

Who can see what

Every account has a role, and every page and every request checks it. A customer sees only their own cases; a reviewer only the cases assigned to them; the Vindex team every case.

CustomerVindex teamLegalAccounting
A case and its documentsTheir ownEvery caseAssignedAssigned
Screening resultsIn the report
AI briefings
Review agents
Internal notes and the audit trail
Suspicious activity reportsCan draftCan draft
Who can see what, by role.
Signing in
Each person has their own account, confirmed by email. Two-step sign-in is supported, and the Vindex team re-enters their password to record a final decision.
Reviewers
Legal and accounting reviewers see a case only once it is assigned to their firm, and only the parts their review needs.
Suspicious activity reports
Kept from the customer entirely, including from their copy of the case report, because disclosing one to the person it concerns is an offence in most jurisdictions.

The audit trail

Everything that happens to a case is recorded as it happens: who did it, what they did, when, and what changed. Submissions, document rulings, requests to the customer, screens, opinions, decisions, reports, every message and every notification. The record cannot be edited.

Each case has its own Audit logs tab, and the Vindex team can search and export the trail across every case from Audit.

How AI is used

Vindex uses Anthropic's Claude models, through Amazon Bedrock, for the work that is reading and writing. A smaller model reads documents; a more capable one handles the work that calls for judgement.

Where it is used
Reading documents and judging image quality; the questions asked for a case's purpose; the risk reasoning; the checks before review; AI mode briefings and source summaries; the review agents; and first drafts of suspicious activity reports.
What it works from
Only the case's own data. It adds nothing it may know about a person or a company from anywhere else.
What it never does
Decide a case, confirm a match, or change anything on a case by itself. A review agent's decision takes effect only when a person accepts it, and only a person records the final decision.
How you can tell
Everything written by AI is labelled as such, with the model that wrote it and when.

Good to know

AI output can be wrong or incomplete. The guide's AI mode and Review agents pages say where its limits are.

Nothing is checked before the customer agrees to the privacy notice and to Vindex running its checks on their behalf. The consent is recorded with its date, the terms version and the language it was given in.

Customers can ask what Vindex holds about them, and the Vindex team answers the request from the case with an export of the data. Requests, and the reviews of how long records are kept, are recorded like everything else.

Documents and storage

Documents are stored privately in cloud storage and are opened only through Vindex, by people allowed to see the case. Each file's fingerprint is recorded when it arrives, so any later change to it would show. Uploads are limited to PDF, JPG, PNG and HEIC files of up to 10 MB.

Reports carry a testing watermark while the service is in trial, so a document produced then cannot be mistaken for a real one.

Glossary and questionsThe words compliance work uses, and answers to the questions people ask most.Risk, decisions and reportsThe risk score, enhanced due diligence, the final decision and the reports it produces.

Something missing or unclear? Signed-in users can tell us from Feedback in the app.