A security review needs an inspectable product scenario and clear operating responsibilities. Bring the people who own identity, infrastructure, data and service acceptance. Velocize connects their questions to access controls, reviewable decisions and evidence across the same work and engineering lifecycle.
What should you inspect during evaluation?
Product controls and review outputs that security, IT, engineering and procurement can assess in the same scenario.
On narrow screens, scroll the table horizontally.
| Area | Product capability | Review output |
|---|---|---|
| Identity and access | SSO through SAML 2.0 or OIDC, MFA, SCIM provisioning and scoped role assignment. | Identity-provider mapping, join/leave scenario, two roles with different access and the access-change history. |
| Customer and supplier separation | Permissions follow records through search, AI, reports, exports and external collaboration. | A restricted requirement, a supplier workspace, a report and a denied access attempt in the agreed scope. |
| AI processing | Role-bound context, eligible providers, private models, BYOK and human review. | Which source reached which model, permitted actions, review owner and the treatment of unavailable or disallowed providers. |
| Location and retention | Data-location and retention policies apply to source records, derived material, exports and operational history. | A data-flow map covering storage, backups, search, logs, model endpoints and support access; record-family retention decisions. |
| Audit and recovery | Attributable decisions, controlled baselines, recovery history and explicit approval responsibilities. | A changed requirement through review and release; a permitted recovery action with its owner and outcome. |
| Support and service terms | Scoped diagnostics, incident and case continuity, package-linked service commitments. | Support-access authorization, maintenance ownership, escalation route, agreed support windows and recovery objectives. |
Bring an assessment checklist to the conversation
Prepare questions, owners and acceptance outputs in one document. The checklist covers the product's public evaluation scope.
Download the evaluation checklist (PDF) ↓Open the browser-readable version →Who can sign in, receive a role and approve work?
Velocize combines enterprise SSO and identity federation with product roles, MFA and machine identities. SAML 2.0 and OpenID Connect support the identity-provider relationship; SCIM supports user-lifecycle provisioning. An identity-provider group contributes membership information, while the effective product role determines what that person can do in the selected organization and workflow.
Evaluate an employee joining, changing responsibility and leaving. Compare a project engineer, a reviewer, an administrator and an external supplier. Inspect how an access change affects current work, search and exports, and how the change remains attributable. The chosen identity-provider configuration and allowed provisioning operations are recorded in the deployment scope.
How does separation survive collaboration and reporting?
An organization's access boundary applies to records and their derived use. Sharing a workspace, producing a report or preparing an AI summary retains the relevant source permissions and purpose. Supplier participation is scoped to the material and actions assigned to that supplier.
Choose a restricted requirement and a supplier-owned change. Follow each through search, the approval view and an export. Inspect a permitted action and a denied action. This gives procurement and security teams a concrete basis for evaluating separation across the lifecycle rather than relying on an isolated login demonstration.
Which information reaches AI, and who accepts the result?
AI operates through assigned roles, allowed sources and eligible providers. Private models, local execution and bring-your-own-key arrangements let organizations choose a processing boundary appropriate to their deployment. Provider selection, context and proposed actions remain connected to the workflow's human review responsibilities.
Inspect an assignment that needs a restricted document and another that must run locally. Review the selected source revision, model destination and permitted tools. Provider contractual data handling, retention and training terms belong in the assessment of the selected provider; the organization's processing decision should cover every destination, including supporting services.
Where do data and operational copies live?
Deployment review covers primary records, indexes, retained evidence, exports, logs and recovery copies. Velocize's data-location and retention controls keep record families and approved processing boundaries explicit. Retention, archival and a justified hold can have different consequences for operational history and accepted evidence.
Prepare a data-flow map with your chosen storage region, backup destinations, model endpoints and support-access routes. Identify which information can be shared, who authorizes it and how expiry is reviewed. The selected agreement states the operating locations and responsibilities that apply to your environment.
How are support, incidents and recovery reviewed?
Support combines customer-safe diagnostics with attributable cases, incident actions and recovery history. A support intervention has an owner and an allowed scope. Service commitments can be related to packages and operational evidence, making the agreed support window and escalation responsibility visible in the service context.
Review a support-access request and a recovery scenario together. Determine who approves diagnostics, who operates backups, who validates a restore and how maintenance is communicated. Response targets, availability commitments and recovery objectives are agreed for the selected service and deployment. The evaluation checklist helps record those decisions without implying a universal service level.
What should the review produce?
Agree an identity-and-role map, an information-flow map, an AI-provider decision, deployment responsibilities, support routes and acceptance scenarios. Link each open question to an owner and the evidence that will close it. Use the downloadable checklist to prepare an informed conversation with the product team.
Standards-oriented product controls support your assurance work. Certificates, independent assessments, data-processing agreements and supplier documents have their own scope and validity. Identify the documents your procurement process requires and review the applicable material with the provider before the commercial decision.