Trust & provenance

Built on a register you can check, not retro-fitted.

Name: VICIYA register of investment firms
Creator: VICIYA
License: Not redistributed. Each record links to its original source, which carries its own terms.

Every record traced to its source — a regulator register or a named industry body — across 46 countries. European data residency, local AI for search, and an on-premises option, designed in from the start.

PostureComputed from the live database

Entity records stored in the EU and UK: —
Person records stored in the EU and UK: —
Erasure of any person record: On request
Search inference on our own servers: 100%

Commitments

Six commitments

European data residency: The application, embeddings and search run in an EU data centre; the database is hosted in London, in the UK, which the EU recognises as giving adequate protection under GDPR. The one exception is the optional AI memo (see “Local-first AI”), which we turn off on request.
Local-first AI: Embeddings, semantic search and classification run on our own infrastructure: your search queries are never sent to an outside AI provider. The optional due-diligence memo is the single exception: it sends facts from the register to an external model provider to draft prose, disclosed under subprocessors below and named on request. It is off by default in on-premises deployments.
GDPR by design: Per-record lawful basis, retention limits, and erasure of any person record on request, within one month. A DPA is available on request once our entity is incorporated.
Every record, sourced: The register — 18,418 investment firms across 46 countries — is built mainly from official regulator registers: SEC, ESMA, FCA, FINMA, MAS and 13 more. A minority of the graph's 22,274 records (929, 4.2%) come from named industry bodies such as LPEA and ALFI, which publish what members declare; those are labelled as such wherever they appear. All 22,274 records carry a source tag and a link back to where they came from.
Grounded agents, not guesses: Agents draft only from register fields and list the records they rest on; a deterministic check flags any figure that is not in a source record. It checks figures, not prose: a wrong name or a soft claim still needs a reader.
On-premises option: For sovereign deployments, the entire VICIYA stack — database, local inference and application — ships as a containerised bundle you run on your own infrastructure. Same product, your perimeter. Not yet deployed with a customer.

Subprocessors

Who processes data on our behalf

Every third party that processes data on our behalf, where they sit, and the authority that supervises them or, for a transfer outside Europe, the safeguard that covers it. Each is named on request, and will be in the DPA once our entity is incorporated. Software we run on our own infrastructure is not listed — a subprocessor is a third party receiving data, and those components send data to no one. We notify customers 30 days before any change.

UK-hosted managed database
Purpose
Record storage
Region
London (UK)
Authority or transfer basis
UK ICO; EU adequacy decision
EU data-centre provider
Purpose
Application hosting: compute and storage
Region
France (EU)
Authority or transfer basis
CNIL
External AI provider
Purpose
Optional AI due-diligence memo drafting (register facts only; named on request; disabled on request and in on-premises deployments)
Region
United States
Authority or transfer basis
SCCs / EU-US DPF

Subprocessor	Purpose	Region	Authority or transfer basis
UK-hosted managed database	Record storage	London (UK)	UK ICO; EU adequacy decision
EU data-centre provider	Application hosting: compute and storage	France (EU)	CNIL
External AI provider	Optional AI due-diligence memo drafting (register facts only; named on request; disabled on request and in on-premises deployments)	United States	SCCs / EU-US DPF

Frameworks

Frameworks & alignment

GDPR (Reg. 2016/679): Designed in; self-assessed, no audit, DPA on incorporation
EU AI Act (Reg. 2024/1689): Provider; not high-risk on current assessment
NIS2 Directive: Used as a reference, not a claim of scope; self-assessed, no audit
DORA (Reg. 2022/2554): ICT third-party resilience, used as a reference, not a claim of scope; self-assessed, no audit
ISO 27001:2022: Roadmap (12 months)
SOC 2 Type II: Roadmap (Enterprise tier)
ENISA EUCS: Tracking

Investors & partners

Materials on request

Diligence materials are shared directly, so we can give you the current version and answer questions alongside it. Ask and we will send it the same day.

Request materials

Or mail hello@viciya.com with the subject “VICIYA materials request”.

Sovereign tier

Not yet deployed

Need on-premises?

For sovereign deployments — banks, insurers, regulators, sovereign wealth — the entire VICIYA stack ships as a containerised bundle you run inside your own perimeter. Not yet deployed with a customer; escrow and air-gapped operation are available to discuss, not yet in place.

Rights

Your GDPR rights

We process some person records (board members, partners) sourced from public regulatory and association directories under legitimate interests (GDPR Art. 6(1)(f)). You can request access, rectification, erasure, portability, or object to processing — at no cost — by emailing hello@viciya.com. We respond within one month; for complex requests the law allows two more months, and we tell you within the first month if we need them.