Value Chain Risk Institute

Your Data, Your Control

The VCRI Vendor Privacy Model — How We Handle Your Security Posture Data
The hardest question every vendor asks: "What does VCRI actually see about us?"

The answer is simpler than you might expect. VCRI sees what you're capable of proving — expressed as categorical signals, never as raw vulnerability data. Your specific CVEs, IP addresses, and security tool configurations stay where they belong: inside your environment.

How Your Data Flows

Security data moves through a 7-stage pipeline. Sensitive specifics are redacted before anything leaves your tools. VCRI receives only the output of that pipeline — never the input.

🔧
Your Tools
CrowdStrike, Okta, Tenable, Splunk, etc.
🔌
CRIBL Ingest
Read-only API pull from your authorized tools
🛡️
Redaction
CVEs masked. IPs removed. Specifics dropped.
📊
Aggregation
"847 vulns" → "Protection: HIGH in Networks"
🏛️
VCRI Receives
Category-level signals only. Nothing identifiable.

What VCRI Sees — and What It Doesn't

✓ What VCRI Receives

  • CAM maturity level per dimension (e.g., Identity: L3)
  • Coverage category signals ("Protection: HIGH")
  • SCF control mapping status (covered / not covered)
  • CMM level per asset class × dimension cell
  • VCAR Dollar-at-Risk (self-attested by you)
  • Trust coefficient scores (α β γ θ)

✗ What VCRI Never Receives

  • Specific CVE identifiers or CVSS scores
  • IP addresses or network topology
  • Usernames, credentials, or account data
  • Raw vulnerability scan output
  • Configuration files or system details
  • Any data your security team would consider sensitive

Five Privacy Principles

1

You Authorize Every Integration

CRIBL API pull requires explicit read-only authorization from your team. Nothing is accessed without your approval. You choose which tools are included and can revoke access at any time.

2

Redaction Runs Before Data Leaves Your Tool

The CRIBL sensitivity redaction function executes as the first processing step. Specific CVEs, IP addresses, and other sensitive identifiers are masked or dropped before they move anywhere. This is a technical control, not a policy promise.

3

VCRI Stores Posture Profiles, Not Raw Data

The VCRI clearinghouse holds your CAM score profile — the aggregated, anonymized representation of your security posture. We do not maintain a database of your raw telemetry, vulnerability inventory, or tool configurations.

4

Your Profile Is Shared Only With Your Customers

Your VCRI profile is visible to organizations that have you as a vendor — customers who have a legitimate need to assess your security posture. It is not visible to your competitors, the general public, or any government agency without legal process.

5

Transparency Is Rewarded, Not Required

Allowing API pull maximizes your trust coefficients (α and β), giving you the strongest possible VCRI score. Vendors who prefer to package and submit their own data may do so — at a lower trust coefficient. Participation level is your choice.

The AI Assistant — Privacy Model

Your VCRI Vendor Assistant Runs on Your Machine

The VCRI Vendor Assistant is a locally-installed AI tool powered by Anthropic's Claude. It runs on your infrastructure. When you ask the assistant a question, that query is sent to Anthropic's API for processing — the same way any Claude-powered tool works.

VCRI never sees your assistant queries. Your questions about your own security environment, your tool inventory, your gaps — all of that stays between you and the Anthropic API.

When you're ready to submit a profile to the VCRI clearinghouse, the assistant helps you generate a structured, anonymized submission package. You review it before it's sent. You control what goes.

Data Type Anthropic API VCRI Clearinghouse Your Machine
Your assistant queries Processed Never Stays here
Raw tool telemetry Not sent Never Stays here
Specific CVEs / IPs Not sent Never Stays here
CAM posture profile Not sent On submission Stays here
Your VCRI score Not sent Visible to customers Your copy

Vendors with enterprise requirements may use Anthropic's enterprise API with a Data Processing Agreement. Contact info@valuechainrisk.org for enterprise configuration guidance.

Transparency is the rational choice.

Automated API pull maximizes your trust coefficients. A strong VCRI score replaces dozens of customer questionnaires — permanently. Your security team answers them once, automatically, for everyone.

Nonprofit Governance — No Conflicts of Interest

VCRI is governed by a board of recognized neutral authorities. No board member sells competing security products. The entire mission is accurate, neutral assessment.

  • Mary Ann Davidson — Former CSO Oracle (40 years)
  • Allan Friedman — Father of SBOM, CISA/NTIA
  • Mitch Parker — CISO IU Health; IEEE/UL 2933 co-chair
  • Lee Neely — Senior Cyber Analyst, LLNL
  • Tom Cornelius — Founder, Secure Controls Framework
  • Robert Hill — Founder, Cyturus Technologies
  • Paul Asadoorian — Principal Researcher, Eclypsium
  • Michael Shea — UN Transparency Protocol