Vellum Buyer FAQ: Security, Implementation & Pricing
How do you handle SOC 2 and ISO 27001 compliance?
Vellum maintains SOC 2 Type II certification with annual audits; our most recent report is available under NDA upon request. We are ISO 27001 certified and conduct penetration testing quarterly through an independent third party. Compliance documentation packages for your security review can be delivered within 24 hours of request.
Where is our data stored, and can we choose the region?
All customer data is stored in AWS with encryption at rest (AES-256) and in transit (TLS 1.3). Enterprise plans can select from US-East, US-West, EU-Frankfurt, or AP-Sydney regions. Data residency commitments are contractually binding and included in our DPA.
What does a typical implementation look like?
Standard implementations run 4-6 weeks: Week 1 for SSO and user provisioning, Weeks 2-3 for integration configuration and data migration, Weeks 4-6 for training and parallel operation. You'll have a dedicated implementation manager and access to our technical team throughout. Most customers are fully operational within 45 days of contract signature.
Do you integrate with Salesforce, DocuSign, and our ERP?
Native integrations exist for Salesforce, HubSpot, DocuSign, Adobe Sign, NetSuite, SAP, and Microsoft Dynamics. All integrations are bidirectional and sync in real-time. For systems outside our native library, we provide a REST API with full documentation and dedicated integration support.
What does Vellum cost, and how are seats counted?
Pricing starts at $850/month for teams up to 10 users, with Enterprise tiers based on contract volume and feature requirements. Seats are counted by named users who can create or edit contracts; unlimited read-only viewers are included at no additional cost. We provide detailed pricing in writing after discovery so you have exact figures for budget approval.
What is your uptime SLA?
We guarantee 99.9% uptime on all paid plans, with credits issued automatically for any month we fall short. Enterprise customers can negotiate 99.95% SLA with dedicated support response times. Current and historical uptime is published at status.vellum.io.
How does pricing scale as we grow?
Volume pricing decreases per-seat and per-contract costs as you scale—specific breakpoints are outlined in every proposal. Annual contracts lock in rates for the term regardless of growth within tier. We conduct annual reviews to ensure you're on the most cost-effective plan for your actual usage.
What is your cancellation policy?
Monthly plans can be cancelled with 30 days notice with no penalty. Annual contracts are non-refundable but can be transferred to an affiliate or successor entity. We do not auto-renew without explicit written confirmation 60 days before term end.
Who owns our data, and what happens if we leave?
You own all data, contracts, and metadata—full stop. Upon termination, we provide a complete data export in standard formats (JSON, CSV, PDF) within 5 business days at no charge. Data is purged from our systems within 30 days of export confirmation unless legal hold applies.
How do you handle HIPAA, GDPR, and state privacy laws?
Vellum signs BAAs for HIPAA-covered entities and offers a pre-signed DPA compliant with GDPR and UK GDPR. We maintain compliance with CCPA, CPRA, and Virginia CDPA with documented data subject request workflows. Our privacy counsel reviews regulatory changes quarterly and updates our controls accordingly.
Can we get a sandbox or trial environment?
Yes. We offer a 14-day full-feature trial environment with sample data, or a sandbox connected to your SSO for hands-on evaluation by your team. Enterprise prospects can request extended pilots with custom configuration at no cost during the sales process.
What if we have a custom integration need?
Our API covers 95% of custom use cases with comprehensive documentation and sandbox access for your developers. For complex integrations, our professional services team scopes custom work at transparent hourly rates, typically $175-225/hour. Integration code you build is yours to own and modify.