What a security review needs to know about VADIX.
Who does the work, how it is built, which compliance frameworks shape the design, and what happens to data — on this website and inside an engagement. Written for the person filling in the procurement questionnaire.
1. Who you are working with
VADIX is founder-led and senior-only. The person on the discovery call is the person who architects and builds the work; vetted specialists are brought in for larger builds under the same standards and the same accountability.
- Microsoft Certified · Azure Solutions Architect Expert
- Microsoft Certified · Azure AI Engineer Associate
- Azure Cloud Adoption & Well-Architected Frameworks
- Zero Trust architecture · Entra ID & Defender
2. How we build
In your tenant, as code
Platforms are deployed into your Azure subscription with Bicep or Terraform, promoted through DEV, QA and PROD, and handed over with the source, the pipelines and the runbooks. You hold the keys from the first environment.
Private by default
Private Link for PaaS services, managed identities instead of stored secrets, Key Vault for the secrets that must exist, customer-managed keys where the framework asks for them, and least-privilege roles throughout.
Reviewed before it is built
Every significant decision is written down as an Architecture Decision Record and reviewed with you before code is written, so audit evidence is a by-product of the build rather than a project at the end.
Observable in production
Application Insights, Azure Monitor and Defender for Cloud are part of the landing zone, not an afterthought. Alerts, dashboards and cost baselines are delivered with the platform.
3. Compliance frameworks we design for
VADIX designs and builds to these frameworks and has delivered platforms inside organisations that are audited against them. VADIX LLC itself is a small consultancy and is not independently certified against them; where your programme needs an attestation, it sits with the platform you own and the auditors you already use.
| Framework | What it means for the build |
|---|---|
| GxP · 21 CFR Part 11 | Validated environments, controlled change, audit trails and electronic-signature controls designed into the platform; documentation written to survive an inspection. |
| HIPAA | Technical safeguards for protected health information: encryption in transit and at rest, access logging, minimum-necessary access, and a Business Associate Agreement where one is required. |
| SOC 2 | Control mapping for security, availability and confidentiality, with evidence collection automated from Azure Policy, Defender and Monitor. |
| PCI DSS | Network segmentation, tokenised payments through a certified processor (for example Stripe), and no cardholder data stored on the platform. |
| ISO 27001 | Policy-as-code and continuous compliance monitoring aligned to the control set your ISMS already uses. |
4. Data handling in an engagement
- Your data stays in your Azure tenant. VADIX works through identities you issue and can revoke, and does not take copies of production data.
- Non-disclosure agreements are signed before any environment access, on your paper or ours.
- Access is scoped to the engagement and removed at handoff; break-glass accounts and their use are documented.
- The only sub-processor for hosted work is Microsoft Azure, in the regions you choose.
5. This website
- Hosting. Azure Static Web Apps in the United States (East US 2), served over HTTPS only.
- Browser protections. A Content Security Policy,
X-Frame-Options,X-Content-Type-Options,Referrer-PolicyandPermissions-Policyheaders are set on every response. - No trackers. No advertising or third-party analytics scripts. Page views are counted per day without cookies, IP addresses or identifiers, and the Do Not Track signal is honoured.
- Forms. Protected by Cloudflare Turnstile and rate limiting. Submissions are stored in Azure Storage and delivered by email through Azure Communication Services. Details are in the privacy notice.
- Demos. The showcase sites are fictional businesses; their forms send nothing. The Architect demo runs on sample data and stores nothing.
- Captain. Our meeting copilot is local-first: transcription runs on your PC and audio never leaves it. Details on the Captain page.
6. The legal entity
VADIX LLC is a Florida limited liability company operating as VADIX from Tampa Bay. Engagements are governed by a written statement of work; this website is governed by the terms of use. Registered-agent and mailing details are provided on contracts and on request.
Contact for security questionnaires, vendor onboarding and DPAs: hello@vadix.net · (813) 322-5551.