Veto holds the evidence an office relies on to move settlement funds. It is built to be defensible — for your office, your auditor, your carrier, and a court.
Account numbers, IDs, tax forms, and raw provider responses live in Vault — redacted by default, surfaced only where policy and role permit.
Field-level access control with full view and export logs. Break-glass access is explicit, time-bound, and recorded.
Reviewer, approver, and release roles are distinct. The person who prepares a record isn't the one who approves an exception.
Sensitive values are hashed and referenced, not echoed onto records. Retention policy is configurable per field.
Enterprise SSO, directory-based provisioning, session and device policy, and audit-log export to your SIEM.
Policy version, source manifest, event log, exceptions, and record status — exportable for any after-the-fact review.
The core abuse question: can anyone make Veto create, consume, or export release-supporting review when the source, policy, exception, or role state does not support it? These are the abuses we design and test against.
AI may prefill source rows; officers confirm. Low-confidence inputs never silently prefill a Review Record as current.
The office decides and acts under its escrow instructions and policies. Veto records the review.
We're standing up the controls and evidence behind these certifications. Status shown is current.
Compliance badges · update as attestations land
We'll walk your team through the Vault model, access controls, threat model, and audit packet — on a real file.