veille Resource, Documentation
Documentation

How Veille works, concepts, API, and onboarding.

Veille is a SaaS platform, no installation required. This documentation covers core concepts, the onboarding flow, the API for programmatic access, and answers to common technical questions.

Core concepts

The four building blocks of Veille.

AI System
Unit of compliance
Any model, algorithm, or automated process that makes or influences decisions using data about individuals. Each system is registered, evaluated, and monitored independently.
Obligation
Article-level requirement
A specific article-level requirement from a regulatory framework. Each obligation has a status, a penalty value, and a set of evidence requirements.
Compliance Check
Agent evaluation
An evaluation run by Veille against a specific system. Produces a compliance score (0-100) and a gap list with remediation drafts.
Vault Artifact
Evidence document
A document or evidence item stored in WORM storage. Each artifact is SHA-256 hashed, timestamped, and linked in a tamper-evident chain.

Onboarding

From zero to first scan in under an hour.

Veille is deployed as a SaaS web application. There is nothing to install. Onboarding follows six steps:

1
Secure login link
Your account is created by invitation. You receive a secure link and set up your credentials.
2
Organization setup
Name, jurisdiction(s), sector. This determines which frameworks are pre-selected for your account.
3
AI system inventory
Declare your known AI systems using the guided intake form. Each system is classified by risk tier, data categories, and applicable frameworks.
4
Evidence collection
Upload existing documentation (PIAs, model cards, transparency notices) for each system. Most organizations don't have everything on day one, that's expected. Whatever is missing gets flagged as a gap, not held against you.
5
Initial compliance scan, and first drafts
Veille evaluates each system against its obligations, article by article. For gaps where evidence simply doesn't exist yet, it drafts the missing document on the spot, full bilingual content, citing the exact article, and routes it to the system owner for review. Each draft is stored as draft_pending_review: the score doesn't move until a human opens it and clicks Validate. First results, including drafts, are typically available within a few minutes of completing the inventory.
6
Ongoing monitoring
The Watch Loop begins monitoring regulatory sources. You receive alerts when changes affect your registered systems.

Data residency

Where your data is processed and stored.

All compliance data, system registry, obligation evaluations, vault artifacts, audit logs, is stored in Amazon S3 and RDS in the ca-central-1 region (Montréal, Canada). Stored data does not leave Canada.

Veille routes each task to the right model in the Claude family, a fast model for high-volume compliance scanning and a frontier model for regulatory-watch materiality assessment, and adopts new Claude models as Anthropic ships them. LLM inference runs on Anthropic's API (US) today and is migrating to AWS Bedrock ca-central-1 for full Canadian residency. The data sent to the model for reasoning consists of obligation text and system metadata, not the raw content of your compliance documents or vault artifacts.

Our commitment

Once the Bedrock migration is active, cross-region inference stays off by design. It re-enables only with the client's written approval, and every evaluation records exactly which model ran, and where. No silent exceptions.

API, Authentication

Bearer token authentication.

All API requests require an Authorization header with a bearer token. Tokens are generated in the dashboard under Settings → API keys.

# Example request curl -X GET https://api.veille.space/v1/systems \ -H "Authorization: Bearer vll_sk_..." \ -H "Content-Type: application/json"

API, Endpoints

Core API endpoints.

GET
/v1/systems
List all registered AI systems with current compliance scores and status.
POST
/v1/systems
Register a new AI system. Accepts name, type, risk tier, frameworks, owner, and documentation.
POST
/v1/systems/{id}/scan
Trigger a compliance scan. Returns score, obligation statuses, and identified gaps.
GET
/v1/vault
List vault artifacts. Filter by system, framework, artifact type, or date range.
POST
/v1/vault
Upload a compliance artifact. Returns the content hash and chain hash for the stored artifact.
GET
/v1/regulatory/changes
List regulatory changes detected by the Watch Loop, with materiality assessments.
GET
/v1/audit
Retrieve the append-only audit log. Each entry includes a SHA-256 hash for tamper detection.

FAQ

Common questions.

Does Veille replace legal counsel?

No. Veille provides compliance monitoring, documentation, and gap identification. Legal interpretation of novel or contested regulatory questions requires qualified counsel.

What data does Veille see?

Veille reasons over obligation text and system metadata you provide. It does not access the raw content of your vault artifacts, model weights, or inference data.

How accurate are the compliance evaluations?

Accurate for clearly-defined, deterministic obligations. For obligations requiring contextual legal judgment, Veille flags the item for human review rather than producing a definitive assessment. All 146 obligations are anchored to official source text (drafts) and pending counsel review, 0/146 are lawyer-validated to date. Legal interpretation remains with qualified counsel.

How often do regulatory updates happen?

Material regulatory changes affecting Canadian AI compliance occur several times per year. In a typical quarter: 1-3 material changes and 5-10 informational or administrative updates.

Questions?

Not covered here?

Write to [email protected] or book a 30-minute technical call. We respond within one business day.

Contact us →