Legal
Security.
Security responsibilities, infrastructure reviews, and how to report a concern.
Security requirements belong in the conversation from the start. This page outlines the topics to review with Vertical for your deployment and how to raise a security concern.
Security for your deployment
AI infrastructure spans facilities, hardware, networks, and the software you run. The relevant controls depend on the location, system design, and scope of the services you purchase.
Use your security review and written service agreement to establish the controls, evidence, and responsibilities required for your workloads. This overview does not certify a deployment or replace agreed security terms.
Infrastructure and access
Before deployment, review the controls applicable to your environment with our team, including:
- Facility access: who can enter the site, visitor procedures, and physical access records.
- System access: administrative permissions, authentication, and access removal.
- Network boundaries: management access, workload connectivity, and isolation requirements.
- Hardware lifecycle: maintenance access, storage handling, and end-of-service data removal.
Ask for confirmation of the specific controls available at the proposed site and for the service you are evaluating.
Shared responsibilities
The service agreement should define where Vertical’s responsibilities end and yours begin. Facility and hardware operations, operating-system maintenance, network configuration, and incident handling should each have an agreed owner.
Unless separately agreed, customers should plan to manage their users, credentials, applications, data permissions, encryption configuration, and backups. Dedicated infrastructure still requires secure workload configuration and ongoing maintenance.
Security reviews and documentation
Share your security questionnaire and requirements with your Vertical representative before committing a workload. Specify the intended location, data sensitivity, compliance obligations, and any required evidence.
Request current documentation for the relevant service and facility. A facility operator’s certification does not automatically certify Vertical or a customer’s deployment. Any assurance should be evaluated against its scope, issuer, and validity dates.
Report a security concern
Contact your existing Vertical representative privately with a suspected vulnerability involving Vertical. Existing customers should use the security or support contact in their service agreement for incidents affecting their service.
Include the affected page or system, a short description, the potential impact, and minimal reproduction steps. Avoid sending credentials, personal information, customer data, or working exploit material in the initial report; request an appropriate channel if sensitive evidence is needed.
Do not access another person’s data, disrupt services, or continue testing after encountering sensitive information. This page does not authorise testing, establish a bug bounty, or promise a reward.
Incident coordination
For contracted services, reporting channels, escalation contacts, and notification obligations are defined by the applicable agreement and law. Keep your organisation’s operational and security contacts current so the appropriate people can be reached.
For information about website data handling, read our Privacy Policy.