Shared Responsibility

viggoVet builds its platform with security, resilience, and reliability at its core. Security in a Software-as-a-Service environment is a shared effort: we secure and operate the platform, and you configure and use it securely. This page explains which security and data-protection responsibilities are ours, which are yours, and which we share. The viggoVet entity responsible for your region is identified in our Legal Entities document.

Scope. This page concerns security and operational responsibilities. It does not change the contractual terms in our Terms of Service, Privacy Policy, or DPA, which prevail if there is any conflict. Responsibility for clinical and professional decisions is addressed in the Terms of Service, not here.

1. viggoVet’s responsibilities

We secure and maintain the platform and the infrastructure behind it, including:

• Infrastructure and hosting: hardened servers, patch management, and secure production networks operated through vetted infrastructure providers.
• Tenant isolation: logical separation of each customer’s data, with confidentiality, integrity, and traceability.
• Encryption: data encrypted in transit (TLS 1.2/1.3) and at rest (AES-256).
• Data residency: customer data stored in encrypted databases mapped to the customer’s region; replication and backups are kept within that region where feasible.
• Network controls: firewalls, intrusion prevention, and monitoring.
• Availability and continuity: we aim for high availability and operate backup and disaster-recovery measures that are periodically tested. Any committed service-level target applies only if and as stated in your order or a separate Service Level Agreement.
• Physical security: access-controlled, monitored facilities with environmental safeguards (provided by infrastructure providers).
• Security programme: we maintain an information-security programme aligned with recognised industry practices and review it regularly.

2. Shared responsibilities

Some areas require both of us to act.

Identity and access management

• We provide: multi-factor authentication, role-based access controls, IP-based restrictions, and session management.
• You are responsible for: enabling and enforcing MFA and strong-password policies, reviewing user roles and permissions, and monitoring account and device activity.

Data management

• We provide: permission configuration, audit logs, backup/export tools, and retention and deletion mechanisms.
• You are responsible for: setting appropriate permissions, reviewing audit trails for anomalies, and retrieving and securely storing your own exports.

Third-party modules and integrations

• We provide: a marketplace and interfaces (SDK, API, MCP) through which independent developers can offer modules, and we execute data-protection terms with our own subprocessors.
• You are responsible for: reviewing a third-party module’s terms and privacy policy before enabling it, and deciding what data to share with it. As set out in the Terms of Service and DPA, third-party modules are provided by independent developers, are not vetted or guaranteed by viggoVet, and are not viggoVet subprocessors.

Incident management

• We provide: investigation of security incidents affecting the platform, notification to affected customers without undue delay, and remediation.
• You are responsible for: notifying your own users and regulators where required, and reporting suspected security issues to the security disclosure form at viggo.vet/legal/security.

Compliance and training

• We provide: secure development practices, staff security training, and support for your DPIAs where applicable.
• You are responsible for: training your users, reviewing our documentation for your use case, and conducting your own compliance reviews.

3. Your responsibilities

You secure and govern your own use of the platform:

• Data accountability: decide how data is shared, with whom, and for how long; ensure your processing is lawful and your data accurate; do not use the services unlawfully or abusively.
• Credentials: use strong, unique passwords; protect login credentials; enable MFA.
• Endpoint security: keep devices, browsers, and apps updated and protected from malware and unauthorised access.
• User and workspace management: for organisation and workspace accounts, manage your users and administrators and the data in your workspace, for which the account holder is responsible.
• Clinical and professional use: the licensed professional remains responsible for all clinical and professional decisions, as set out in the Terms of Service.

4. Contact

Security questions: the security disclosure form at viggo.vet/legal/. General support: the support centre at support.viggo.vet. Privacy and legal: the contact form at viggo.vet/legal/contact.

Cloud security is a collaborative effort: we build secure tools, and you must configure and use them securely. This page is a description of responsibilities and does not by itself create obligations beyond the agreements that reference it.