Velocize — Enterprise evaluation checklist

Public product evaluation scope for security, IT, engineering and procurement. Assign owners and acceptance outputs around a real scenario.

1. Controls and review outputs

Area	Velocize capability	Review output
Identity and access	SSO through SAML 2.0 or OIDC, MFA, SCIM provisioning and scoped role assignment.	Identity-provider mapping, join/leave scenario, two roles with different access and the access-change history.
Customer and supplier separation	Permissions follow records through search, AI, reports, exports and external collaboration.	A restricted requirement, a supplier workspace, a report and a denied access attempt in the agreed scope.
AI processing	Role-bound context, eligible providers, private models, BYOK and human review.	Which source reached which model, permitted actions, review owner and the treatment of unavailable or disallowed providers.
Location and retention	Data-location and retention policies apply to source records, derived material, exports and operational history.	A data-flow map covering storage, backups, search, logs, model endpoints and support access; record-family retention decisions.
Audit and recovery	Attributable decisions, controlled baselines, recovery history and explicit approval responsibilities.	A changed requirement through review and release; a permitted recovery action with its owner and outcome.
Support and service terms	Scoped diagnostics, incident and case continuity, package-linked service commitments.	Support-access authorization, maintenance ownership, escalation route, agreed support windows and recovery objectives.

Area

Velocize capability

Review output

Identity and access

SSO through SAML 2.0 or OIDC, MFA, SCIM provisioning and scoped role assignment.

Identity-provider mapping, join/leave scenario, two roles with different access and the access-change history.

Customer and supplier separation

Permissions follow records through search, AI, reports, exports and external collaboration.

A restricted requirement, a supplier workspace, a report and a denied access attempt in the agreed scope.

AI processing

Role-bound context, eligible providers, private models, BYOK and human review.

Which source reached which model, permitted actions, review owner and the treatment of unavailable or disallowed providers.

Location and retention

Data-location and retention policies apply to source records, derived material, exports and operational history.

A data-flow map covering storage, backups, search, logs, model endpoints and support access; record-family retention decisions.

Audit and recovery

Attributable decisions, controlled baselines, recovery history and explicit approval responsibilities.

A changed requirement through review and release; a permitted recovery action with its owner and outcome.

Support and service terms

Scoped diagnostics, incident and case continuity, package-linked service commitments.

Support-access authorization, maintenance ownership, escalation route, agreed support windows and recovery objectives.

2. Deployment and operating responsibility

Model	Environment	AI route	Responsibility
SaaS	Service-operated environment under the agreed hosting and data-location terms.	Approved model providers or an authorized private-model connection.	Service operation, support access, backups and recovery responsibilities are recorded in the service scope.
Private cloud	A selected private environment with controlled network and identity boundaries.	Private endpoints and provider routes permitted by the organization's policy.	The infrastructure operator and Velocize product-support responsibilities are assigned explicitly.
Connected on-premises	Customer infrastructure with approved external integration and update routes.	Local models or explicitly approved external providers.	Customer IT operates the environment; product support, updates and diagnostic sharing follow the agreement.
Isolated / offline	An isolated customer environment with controlled license, update and exchange packages.	Local or in-boundary models; an external AI provider is not required for the lifecycle workflow.	Agree offline update handling, authorized transfer, restoration and bounded support diagnostics.

3. Acceptance and open decisions

Package, provider, data location, support windows, response and recovery targets are defined for the selected service and agreement. Certificates and independent assessments are reviewed within their own scope and validity.