Know where your data goes.
Where Vesta Online runs, what the AI Advisor sees, and the outside services behind its main features, so your IRB, privacy office or IT team can review it quickly.
This page summarizes how Vesta handles data. Our Privacy Policy is the full legal statement.
Hosted on AWS
Vesta Online runs on Amazon Web Services in the us-east-1 region: the server on ECS Fargate, project files in Amazon S3 and the database in Amazon Aurora PostgreSQL, which accepts connections only from the server.HTTPS end to end, and a web application firewall
Browsers reach the app and its API through Amazon CloudFront, which redirects plain HTTP to HTTPS and requires TLS 1.2 or later on Vesta's hostnames. In production, CloudFront reaches the API's load balancer over HTTPS only, with TLS 1.2, and the load balancer accepts nothing else. AWS WAF applies AWS's managed common and known-bad-input rule sets in front of CloudFront and the load balancer.Encrypted at rest, bucket closed to the public
The database's storage is encrypted, and project files in S3 are encrypted with AES-256 server-side encryption. The project bucket blocks every form of public access.Backups
The production database runs in two availability zones, keeps 35 days of automated backups for point-in-time recovery, and has deletion protection on. In S3, an overwritten or deleted project file stays recoverable for 30 days.Sign-in
Users currently sign in with email or Google through BioMedware's authentication service, which runs on Auth0 at auth.biomedware.com. The browser app uses OpenID Connect with the authorization code flow and PKCE, and the server validates the access token on API calls.Your projects, your account
Cloud projects belong to your account. Project owners can share read-only access with invited recipients. When a share link is issued, anyone possessing that link can open the shared project without signing in. Links can be revoked by the owner and currently do not expire automatically. Each account has 5 GB of project storage by default, up to 1 GB per project.Every save is a version
Each save is kept as a version, and the owner can restore an earlier one.Advisor on Amazon Bedrock
The AI Advisor answers every customer account with Claude Haiku 5.5 on Amazon Bedrock; only BioMedware staff accounts can choose a different model. The Vesta server calls Bedrock directly under its own AWS role, so no model API key exists to leak.A medical-advice guardrail
In production, each Advisor question and answer on Bedrock passes through an Amazon Bedrock guardrail that blocks individualized medical diagnosis or treatment advice.Advisor limits
Each account has a daily Advisor token budget and can start at most 6 Advisor turns a minute.SOC 2
BioMedware has not undergone an independent SOC 2 audit. Vesta Online operates on Amazon Web Services (AWS) infrastructure with security controls including encryption, access restrictions, monitoring, and backups. BioMedware provides information about its security practices and responds to institutional vendor security questionnaires upon request.Data retention
Canceling a subscription does not immediately delete stored projects. Customers may initiate account deletion, subject to a 14-day grace period. Different backup types follow their documented retention schedules.Usage data
Vesta collects anonymous aggregate counts of feature use and also records some activity associated with user accounts for operational and support purposes. Selected account events may be sent to BioMedware's customer relationship management system. Our Privacy Policy provides additional detail.Privacy Policy →Vesta Advisor and Amazon Bedrock
Vesta Advisor uses Amazon Bedrock. AWS states that customer prompts and responses are not used to train underlying models or shared with model providers. Vesta is designed to minimize project information sent to the Advisor.AWS: Amazon Bedrock data protection →What the AI Advisor sends
What is sent with each questionYour question and the conversation so far, plus a summary of the open project: dataset names, variable names, the source file names of imported variables, geometry types, observation counts and the workspace state. Data visibility is off by default. When you turn it on, summary statistics and analysis results are sent as well, and the Advisor can look up your data values for specific places when it needs them.
What is not sentYour project file, geometry coordinates, file paths, and your name or email are not sent with Advisor questions.
Outside services behind the main features
We disclose the third-party services used to operate Vesta Online and, separately, the services supporting our website, marketing and scheduling. Each entry identifies the service's purpose and the categories of information involved.
Vesta Online
| Service | Purpose | When | Data sent |
|---|---|---|---|
| Auth0 | Sign-in | When you sign in | Your sign-in, on Auth0's page at auth.biomedware.com; the app asks for your profile and email address |
| MapTiler (through Vesta) | Basemaps | When a map draws | Requests for basemap styles and tiles, made by the Vesta server so the MapTiler key never reaches your browser |
| Amazon Bedrock | AI Advisor | When you ask the Advisor | Your question and a summary of the open project: dataset and variable names, geometry types and observation counts. With data visibility on: summary statistics, analysis results and values for specific places |
| Public data sources | Data Library imports | When you import | The data you ask for, requested by the Vesta server from the source (for example, the US Census Bureau's API) |
| Stripe | Billing | When you buy a subscription | Your account email, to start a Stripe Checkout session for the purchase |
| Amazon SES | Account email | When Vesta emails you, for example about an account deletion request | Your email address and the message |
| Sign-in | When you choose to sign in with Google | Your sign-in, on Google's own page; Auth0 receives your Google profile and email address | |
| Nutshell | BioMedware's customer records | When your trial or license is about to end, and the first time you open Vesta desktop or Vesta Online | Your account and the event, so BioMedware staff can follow up |
| Google Analytics (GA4) | Sign-up measurement | When an account is created | One sign-up event, sent by the Vesta server: the sign-up method (email or Google), the platform, and a browser client ID and session ID. No name or email address |
Website, marketing and scheduling
| Service | Purpose | When | Data sent |
|---|---|---|---|
| Google Analytics 4 | Website measurement | When you browse vestastats.com, docs.vestastats.com or academy.vestastats.com. For visitors from the EU, EEA and UK, analytics storage stays denied until you accept in the cookie banner | Page views and events such as booking clicks, completed bookings and form submissions (which form, not what you typed), with a Google Analytics browser identifier. Once analytics is allowed, links into Vesta Online carry that identifier so a sign-up can be credited to the visit |
| Nutshell | Contact, newsletter and Academy waitlist forms; page tracking | When you use one of those forms. Page tracking runs on the live sites only, and for visitors from the EU, EEA and UK only after you accept analytics | What you enter in the form. Page tracking records the pages you view on vestastats.com, so a form you submit shows BioMedware what you looked at |
| hCaptcha | Spam protection on the Nutshell forms | When you use a Nutshell form; it runs invisibly | Whatever hCaptcha collects to tell people from automated senders, under hCaptcha's own Privacy Policy, which each form links to |
| Calendly | Scheduling an optional kickoff call | When the scheduler appears on /trial | What you enter to book. If analytics is allowed, the scheduler also gets the campaign tags from the link that brought you to the site and your Google Analytics identifier; otherwise it gets only the campaign tags in the page's own address |
| Amazon CloudFront and S3 | Hosting vestastats.com, docs.vestastats.com and academy.vestastats.com | Every page view | Your browser's ordinary request for the page. CloudFront also reads your country from the request, only to decide whether to show the cookie banner |