Reads where your data already lives. Proves every action without asking you to trust the database.

The right connector for each kind of source, all feeding one place.

The environment reaches into your stack where it already lives, and it meets each system on that system’s own terms. Every source type gets its own connector, built for how that system actually works. Whatever the source, it lands as the same thing: a dated, sourced observation attached to the part of the business it touches, ready to enter the one model everything else on this page is built on. The badges are honest about what runs end-to-end today versus what’s built and waiting on a live hookup. We put that distinction up front rather than in a footnote.

Internal and external signals, one causal model. This is the spine of the page.

Everything else here is this. Isolation is the boundary this model holds. Federation is this model getting sharper. Audit is this model proving what it did. Read the sections below as different sides of the same structure, not separate controls. Most tools keep your data in one place and leave the outside world in another dashboard you have to read yourself. Vyom folds the two together. Your jobs, invoices, schedules, and change orders enter the same model as the weather over your sites, commodity prices, macro rates, regulatory filings, and news. They arrive through different connectors, but they don’t just land side by side. Each external signal is interpreted through the causal model before it enters: assigned to the nodes it affects, given an effect prior, and scored for confidence. That grounding is what turns a forecasted freeze into a reasoned threat to a specific concrete pour, or a steel-price move into a reasoned change to a live bid. You get a causal chain instead of two widgets sitting next to each other. And every observation carries its source, so you always see whether a number came from your live systems or from a starting estimate.

One tenant can’t see another’s data. Access is decided by policy, denied by default.

For the model to be one world per company, the boundary around each company’s copy of it has to hold. Two questions come first in any security review: can one customer reach another’s data, and how do we control what our own people see. Isolation is enforced, not trusted. Every query is scoped to its tenant and checked before it runs, and a query that isn’t correctly scoped fails closed rather than returning a row. Above it sits an attribute-based policy engine: access is denied unless a rule explicitly permits it, and every decision is explainable. Enterprise sign-in maps a verified identity from your provider to a Vyom principal in the right tenant. SCIM ties access to your HR lifecycle, so a termination revokes access without manual cleanup.

Learning that shares patterns, never data.

The same model that stays inside your boundary also gets sharper as more companies run on it, and that never means your data leaves your control. What crosses between companies is patterns rather than records: the strength and direction of a causal relationship, expressed as statistics, with formal differential-privacy noise added before anything is released. Adding or removing any single company changes the shared result by a bounded, provable amount, so no one company’s contribution can be reverse-engineered. Three controls sit in front of release.

So a new company starts with priors learned across the field instead of from zero, and no company ever sees another’s numbers.

Every governed action authorized, signed, and re-verified in your browser.

Because the model acts, not just reports, every action it takes has to be provable. Before a governed agent acts, the action is checked against policy (who may do what, on which resource, under which conditions) and denied by default unless a rule explicitly permits it. Once it runs, it’s written to a tamper-evident log: each entry is hash-chained to the one before it, so altering or deleting any record breaks the chain and the break is visible. Entries are also rolled into a Merkle tree, which produces a single root that stands for the whole log. Your browser re-verifies the full chain and recomputes that root on its own math, so you confirm the record without trusting Vyom’s database. Browser and server use the identical construction, and parity is proven in our CI.

Each row is a governed action Vyom took, hashed together with the one before it. Change a single character in any value and that record and every record after it turn red, and the root stops matching. This is the same check your browser runs on the real log, so you confirm what happened without trusting our database.

Keys stay in the vault. Data is encrypted. Deletion is complete, with one named exception.

The rest is the plain hygiene under all of it. Secrets go straight to an encrypted vault, AES-256-GCM; the setup flow never sees the value. OAuth tokens are authorized with the vendor; the token lives in the vault. In transit, TLS everywhere. Access is policy-as-code: explicit permissions, every denial logged. Data is labeled by origin, so a live figure is never shown as a prior, or the reverse. Deletion is complete: records are erased from Convex and Postgres automatically, and the Neo4j graph is cleared on request.

Where your data lives, how long it’s kept, and where we are on certification.

The mechanisms above prove how the environment behaves. This is the governance a procurement team asks for, stated plainly, including what isn’t done yet. Data residency is enforced, not promised: set a region and the router never serves a read or write from outside it. A request that can only be satisfied across the boundary is refused rather than allowed to leak, the same fail-closed discipline as tenant isolation. Retention is bounded: backup snapshots expire within 90 days under the default policy. Erasure removes a tenant’s records from the primary stores automatically and the graph on request. The one deliberate exception is tamper-evident audit history, kept for accountability; erase the tenant itself to remove that too.