Vault SDK Plugin · Your data never leaves your infrastructure

Ask your Vault.
Get answers,
not links.

VaultIQ installs directly inside your Veeva Vault and answers questions in plain English — with citations — using only your own documents. Your documents never leave your infrastructure.

Runs inside Vault SDK
RBAC enforced
AWS · Azure · GCP
Cited answers only
VaultIQ — Document Search
● Live
vault.company.com / vaultiq RBAC enforced
Vault SDK Plugin — no separate server
Documents never leave Vault
AWS · Azure · GCP
Every answer cites a source
The problem

Your documents have the answers. Finding them doesn't.

Veeva Vault holds your SOPs, protocols, regulatory submissions, and quality records. Getting answers out of them is still manual, slow, and unreliable.

01

Search returns files, not answers

Standard Vault search gives you a list of documents. Someone still has to open each one, read it, and find the relevant paragraph — on every query, every day.

02

Keywords miss meaning

A search for "storage temperature" misses a document that says "maintain between 2°C and 8°C." VQL FIND matches words, not intent.

03

AI tools require your documents to leave

Every commercial AI document tool asks you to upload your documents to their cloud. In pharma and life sciences, that's a non-starter for IT and compliance.

04

Compliance can't afford hallucination

An AI that makes up answers is worse than no AI at all. If you can't trust every sentence, you still have to read the document — the tool adds friction, not value.

How it works

From question to cited answer in seconds

Four steps. All running inside your Vault and your cloud account.

STEP 01

Question asked

A user types a question in plain English inside Vault. No query syntax, no special commands.

STEP 02

Hybrid search

VaultIQ searches simultaneously by keyword (Vault VQL) and by meaning (AI vector search). Documents that match by intent appear even without exact keywords.

STEP 03

RBAC check

Results are filtered through Vault's own access controls. If a user cannot see a document in Vault, that document does not appear in the answer.

STEP 04

Cited answer

A plain-English answer is returned with numbered citations. Every sentence traces back to a specific document. Any sentence that can't be cited is removed before you see it.

Everything runs inside your Vault and your cloud account. Your documents never move to VaultIQ's servers — or anyone else's.
Multi-cloud support

Your cloud. Your choice.

VaultIQ runs entirely inside your cloud account. Switch providers by changing a single Vault Setting — no JAR rebuild, no redeployment.

AWS

Amazon Web Services

Default provider
Embeddings
Amazon Titan Embed v2 (1536-dim)
Language model
Claude Haiku 3.5 / Sonnet 3.5
Vector store
OpenSearch Serverless
Auth
STS short-lived credentials
Networking
VPC PrivateLink (optional)
Data stays in
Your AWS account
Azure

Microsoft Azure

Any Azure region
Embeddings
Azure OpenAI (any deployment)
Language model
GPT-4o mini / GPT-4o
Vector store
Azure AI Search
Auth
API key
Networking
Azure Private Endpoints
Data stays in
Your Azure subscription
GCP

Google Cloud

Any Vertex AI region
Embeddings
Vertex AI text-embedding-004
Language model
Gemini 1.5 Flash / Pro
Vector store
Vertex AI Vector Search
Auth
Service account JWT, auto-refreshed
Networking
VPC Service Controls
Data stays in
Your GCP project
All compute costs are billed directly to your cloud account. VaultIQ does not sit between you and your cloud provider.
Data residency & security

Your documents stay in your Vault. Your embeddings stay in your cloud account. VaultIQ never touches either.

Document text never stored outside Vault

Only embedding vectors and routing metadata are stored in the vector index. Document text is never written anywhere outside Vault.

RBAC respected, not bypassed

All Vault API calls run under the calling user's session token. Vault's own permission system governs what each user can see — the vector index is never a shortcut around permissions.

No model training on your documents

AI models are called at inference time with document snippets as context. No document content is retained by VaultIQ after the query is answered.

Outbound-only network model

Vault makes outbound HTTPS calls to your cloud AI endpoints. No inbound connections required. No firewall rules to open inward.

Request Flow — End to End
Vault Environment
User in Vault Natural-language question · session token attached
session token
↓ HTTPS · session token · Vault SDK invokes action 1
VaultIQ Plugin (JAR) Classify · VQL · RBAC · quota
inside Vault
② VQL+RBAC
Vault Docs RBAC-filtered
↓ Outbound HTTPS · embed query + vector kNN (no doc text leaves Vault) 3
Your Cloud Account — AWS · Azure · GCP
⚡ Embed
Titan v2 / AzureOAI
/ Vertex text-004
🗃 Vector kNN
OpenSearch /
AI Search / Vertex
🤖 LLM Synthesis
Claude / GPT-4o
/ Gemini
All compute billed to your account · data stays in your region
↑ Cited answer returned · no document text persisted outside Vault 4
User receives cited answer Plain-English answer with [1][2] clickable citations to source documents
cited only
Credential service — out of request path
VirsAI Token Service ⑤ Verifies subscription · issues short-lived cloud credentials only · never receives documents or queries
credential only
Waiting for query…
Vault environment — your infrastructure
Your cloud account — your bill
VirsAI: credentials only, no data
Features

Built for regulated document environments

Every feature exists because a pharma or life sciences team needs it — not because it's on a generic AI checklist.

Token quotas per user & role

Set monthly token limits per user or Vault role in Vault Settings — no code changes. Users see a clear message when their limit is reached; admins can monitor usage at any time.

Hybrid search

Combines Vault VQL keyword search with semantic vector search simultaneously. Documents that match by meaning appear even without exact keywords.

Grounding enforcement

Every sentence must cite a document snippet. Sentences without citations are stripped automatically — the model cannot say something it cannot prove.

RBAC compliance

All queries run under the calling user's Vault session token. Vault's own permission system governs what each user can see — VaultIQ never elevates privilege.

Expiry search

"Show me documents expiring in the next 30 days" returns a formatted table from Vault metadata — document name, version, expiry date — with no LLM call needed.

Lifecycle-triggered indexing

Documents index automatically when they reach a configured lifecycle state. No manual step. New versions replace old index entries automatically.

Intent classification

Automatically routes queries to the right search strategy — document content, metadata attributes, or expiry — without the user learning any query syntax.

Zero-server deployment

The JAR is the entire deployment artifact. No containers, no servers, no infrastructure to manage. Upload to Vault, configure settings, done.

Smart model routing

Simple queries use a faster, cheaper model. Complex multi-document synthesis uses a more capable model. Cost is optimized per query — automatically.

Embedding cache

Repeated queries skip the embedding call entirely — saving ~100–180ms per cache hit. Cache size and TTL are tunable via Vault Settings.

Prompt injection defense

User queries are sanitized to prevent attempts to override system instructions through crafted input — role prefixes, HTML tags, and injection patterns are stripped.

Honest abstention

When documents don't contain the answer, VaultIQ says: "I cannot answer this from the available documents." It does not fill gaps with training data.

Setup

Live in under a week.

We scope setup at under a week to give your cloud and Vault teams realistic time to provision infrastructure, complete internal change management, and run thorough smoke tests — without rushing.

Why not same-day?
Cloud resource provisioning, internal security review, and Vault change management typically take 2–3 business days. We'd rather you go live confidently than quickly.
No containers or servers to manage
No vendor access to your Vault or cloud
No code to write — all configuration via Vault Settings UI
No ongoing infrastructure to maintain after go-live
Supported Vault editions
Vault Professional · Vault Enterprise
Requires Vault SDK · version 24.1.0 or later
Pricing

Subscription-based. Cloud costs stay yours.

A per-tenant subscription covers the license, the JAR, updates, and support. Your cloud AI costs are billed directly to your cloud account — VaultIQ does not mark these up.

VaultIQ License
Per-tenant, annual subscription

License key issuance — cryptographically signed JWT, pasted into one Vault Setting

The JAR — versioned releases, backwards compatible, no rebuild required for config changes

Updates and support — new cloud provider support, Vault SDK compatibility updates

Cloud AI costs go to your cloud bill directly — AWS, Azure, or GCP. VaultIQ takes no cut.

If your subscription lapses, the agent stops processing queries immediately. Your vector store data is not deleted — re-activate to resume.
Contact VirsAI to get pricing →
FAQ

Common questions

No. Only embedding vectors — mathematical representations of text, not readable text — are stored in your vector index, in your cloud account. The documents themselves never leave Vault. The vector index contains float arrays and document IDs, not the original text.
No. VaultIQ uses the calling user's Vault session token for all Vault API calls. If Vault denies that user access to a document, the document does not appear in search results or answers. The vector index may contain that document's embedding, but the RBAC check runs before the answer is composed.
Vault administrators configure monthly token limits per individual user (by email) or per Vault role in Vault Settings — no code changes required. Limits reset at the start of each calendar month. When a user hits their limit they receive a clear message. Role-level limits apply to all users in that role; user-level limits take precedence over role limits if both are set. Admins can view current usage from Vault Settings at any time.
VaultIQ says exactly: "I cannot answer this from the available documents." It does not guess, infer, or supplement with training data. If no documents match the query well enough, you get a clear message instead of a confident wrong answer.
Yes. Set cloud_provider__c to azure or gcp in Vault Settings and provide the corresponding endpoints and credentials. No JAR rebuild required. Azure uses Azure OpenAI + Azure AI Search. GCP uses Vertex AI (Gemini + text-embedding-004) + Vertex AI Vector Search.
Under a week, end to end. The technical configuration (JAR upload, Vault Settings, lifecycle wiring) takes about a day of effort. The remaining time is typically internal: waiting on cloud resource provisioning approvals, IT security review, and Vault change management. No professional services from VirsAI are required.
No. VaultIQ calls AI models at inference time — document snippets are passed as context for a single query and discarded. VaultIQ does not send your documents to any model training pipeline. No document content is retained by VaultIQ after the query is answered.
Vault Professional or Enterprise with Vault SDK support enabled, version 24.1.0 or later. If you're unsure whether your Vault instance has SDK support, check with your Vault account team.

Ready to make your Vault answerable?

Runs inside your infrastructure. Live in under a week. Your documents stay yours.

< 1 week
Time to go live
0
Servers to manage
3
Cloud providers
100%
Answers cite a source
Doc ID Status Type