Subject Access Requests, end to end — with redaction you can prove.
Vellum handles the whole statutory lifecycle for UK public bodies: intake and the clock, mixed-format ingest, detection, human review, verified release, and an audit trail that can be checked rather than believed.
Every vendor will tell you their detection is accurate. Vellum does not ask you to take that on trust. It makes a missed redaction unable to reach the requester unseen.
Built by RODMENA LIMITED. The demonstration runs on entirely fabricated case data.
How a request moves through Vellum
Intake and the statutory clock
The month runs from the day of receipt, or from identity confirmation where one is needed, and ends on the corresponding date of the following month — rolling to the next working day, and falling to the month end where there is no corresponding date. Clarification stops the clock only where it concerns the information requested, not the format of the response. The arithmetic is shown, so an information governance officer can check it rather than take it on trust.
Ingest, whatever the pack contains
PDF, Word, Excel, PowerPoint, OpenDocument, images and plain text, identified by content rather than by filename — because in a real pack the extension is a claim made by whoever named the file. Emails and archives are unpacked as document families so attachments stay with their parent.
Concealed content, before anyone reviews
Content a reviewer could never see on screen is found at ingest and put in its own queue that cannot be skipped: optional-content layers that are switched off, white-on-white and zero-size text, content positioned off the page, annotations and comments, tracked changes, document properties, hidden worksheets, hidden rows and columns, and pivot caches. Each one names the mechanism that concealed it.
Detection that shows its working
UK identifiers validated against their own specifications — NHS numbers by Modulus 11, National Insurance numbers, DfE pupil numbers by check letter, postcodes, telephone numbers, sort codes, dates of birth. Every candidate carries the detector, its version, and the rule or checksum that made it fire. A reviewer shown only a verdict cannot challenge it, and a recommendation that cannot be challenged is the mechanism of automation bias.
One decision, applied across the whole pack
Inconsistent recording is the norm in a real file. The Party Register proposes the variant spellings it finds in the papers — Okonkwo-Bassey, Chloe, C. Okonkwo-Bassey — a human confirms which are the same person, and the confirmed forms are then applied exactly and identically everywhere. Fuzzy when the register is built; deterministic when it is applied.
Review under human control
Accept, reject or amend, with the statutory basis chosen before acceptance and the ICO's three-step test recorded for third-party material. The Party Register holds capacity separately from role, because the professional exemption turns on acting in an official capacity — so a social worker is named and their home address is not.
Release that has been proven, not asserted
Redactions are burned at the pixel level on the pages that carry them; retained text is re-injected from stored geometry rather than re-recognised, so nothing is corrupted. The finished bundle is then checked by three independent paths, and each is first shown to fail against controls carrying planted text. Release is refused while any page is undecided, and refused if the verification suite could not be proven capable of failing.
An audit trail that can be checked
Every event — including reads — is hash-chained to its predecessor, so altering or removing a historic entry invalidates every hash after it and the break is detectable without a second copy of the log. The chain names the sequence where a break begins, and the verifier that reports it is itself tested by corrupting an entry and requiring it to go red.
Where the AI sits, and where it does not
The model never writes the document
Findings from any language model are candidates for a reviewer, never edits. They are discarded unless they quote text that exists verbatim in the document, and the proportion discarded is published as a hallucination rate rather than hidden.
Turning it off leaves a working system
Deterministic detection and the Party Register are a complete product on their own. Switching AI off reduces recall and breaks nothing — which is the honest answer to "what is the functional impact of opting out?", demonstrated by re-running a case rather than asserted on a form.
Every gate is shown to fail first
Before any model output is believed, the harness must find planted personal data in a control document. A second control carries an instruction inside its text; if its presence changes the outcome, the tier is disabled for that run. In a subject access request the applicant may have put documents into their own file, so that is an ordinary input rather than a hypothetical.
Every byte that leaves is logged
Model, version, region, purpose, the redaction state at the moment of sending, token counts and prompt hash. The log is kept even when the tier is switched off, because an empty egress log on a completed case is itself the evidence that nothing was sent.
What exists today
This table is generated from the product's own feature register — the same data behind every badge inside the application. Three states only, and the distinction is deliberate: Not in this demo means the capability exists and is switched off here, while anything not yet built says Planned. Labelling unbuilt work as merely disabled is the kind of claim that does not survive due diligence.
14 available · 0 not in this demonstration · 6 planned
Casework
- Case intake and statutory clock Available
Records receipt, identity confirmation, extensions and clarification, and computes the statutory deadline.
- Party Register Available
Names every individual in the case with their role and capacity, and drives consistent treatment across the whole pack.
- Freedom of Information policy pack Planned
The same machinery against the FOIA exemption set.
Ingest
- Mixed-format ingest Available
PDF, Word, Excel, PowerPoint, OpenDocument, images and plain text, identified by content rather than by filename.
- Concealed content discovery Available
Finds content a reviewer could not see on screen and puts it in its own queue, naming the mechanism that concealed it.
- OCR for scanned records Planned
Recognising text in scanned pages so they can be searched and reviewed.
- Handwriting recognition Planned
Cursive and handwritten contact notes.
Review
- Detection with stated evidence Available
Every candidate carries the detector, its version, and the rule or checksum that caused it to fire.
- Consistent entities across the pack Available
A name confirmed once is applied identically to every document, and the result is reproducible byte for byte.
- ICO three-step third-party test Available
Records each step and each factor weighed, not only the conclusion.
- LLM assurance tier Available
A second opinion over the already-redacted rendition, returning findings for a human rather than edits to a document.
Release
- Falsifiable release verification Available
Checks the finished bundle by independent paths, after first proving the checks can fail on deliberately dirty controls.
- PDF/A-2b output with validation Planned
Archival-format bundles validated before release.
- Vector-mode redaction Planned
Removing text from the content stream while keeping the page vector.
Governance
- Tenant isolation enforced by the database Available
Each licensed organisation's data is separated by PostgreSQL row-level security, not by application code remembering to filter.
- Irretrievable erasure with a surviving audit trail Available
Deleting a case destroys its content and its files on disk, and leaves the record that the deletion happened.
- Hash-chained audit trail Available
Records reads as well as writes, and detects alteration or removal of a historic entry.
- AI governance and opt-out Available
The assurance tier can be switched off per tenant or per case; the system still completes a case without it.
- Microsoft Entra single sign-on Available
Sign in with your own organisation's Microsoft directory.
- User and role administration Planned
Creating users, assigning roles and reviewing permission changes from inside the product.
How to check us
Every claim on this page is one you can test rather than take on trust. That is the product, not a caveat about it — a redaction platform whose assurances cannot be checked is asking for exactly the faith that put your service at risk in the first place.
- Isolation is enforced by PostgreSQL, not by our code remembering. Every table carrying customer data has row-level security enabled and forced, so the policy applies to the schema owner too. The application connects as a role that owns nothing and holds neither superuser nor BYPASSRLS. Thirty-one tests attack one tenant from another and require the read to come back empty — each paired with a control proving the same query returns rows for its rightful owner, because an empty result from a broken query proves nothing.
- Accuracy is measured on your documents, not quoted from someone else's. Vellum reports precision and recall against a ground-truth answer key, per entity class, for the pack in front of you. A vendor accuracy figure describes a corpus you will never send and cannot audit.
- The audit trail detects alteration without a second copy of itself. Every event is hash-chained to its predecessor, so changing or removing a historic entry invalidates every hash after it and names the sequence where the break begins. The verifier is itself tested by deliberately corrupting an entry and requiring it to go red — an integrity indicator that has only ever shown green is not evidence of anything.
- Release is refused, not merely warned about. A bundle cannot be produced while any page is undecided, and cannot be produced if the verification suite has not first been shown capable of failing against controls carrying planted text. The gate is the default, and turning it off is a deliberate configuration change with your name on it.
- The policy pack is yours to version. The statutory grounds ship as a starting position your data protection officer reviews, amends and versions — configurable by design, because the exemption your authority applies is a decision your authority owns.