# Vanta universe update 001

Design only. This document is the update to copy into the Vanta service portal. It does not create records, and it does not connect a customer database.

## Where things live

- This site is the design and the framework. It does not hold live customer records.
- The Vanta service portal is the only place that ties to customer portals.
- Each customer has their own portal and their own database.
- Nothing is copied back from a customer portal.

## Who can be connected

Only a Vanta NDT person can be connected across the universe. A customer person never can.

A person is connectable only when all of these are true:

- Their account is Vanta NDT, or their role is internal or operations.
- They are active and allowed to sign in.
- A universe grant names where they may connect: every customer portal, or specific ones.

Connect means they may show up and talk. It does not mean they may write that customer's records.

They sign in on the Vanta portal only. A short-lived token is bound to that person and that one portal. The customer portal checks the token with the Vanta portal over HTTPS. It does not store a Vanta password, and it does not open the Vanta database.

## Chat

A customer, from their own portal, can message Vanta NDT personnel.

- The customer stays a user of their own portal.
- Their portal calls the Vanta portal with its own universe key.
- The thread is stored on the Vanta side, in that customer's room.
- The thread does not reach any other customer.
- A Vanta person does not have to be signed into the customer portal for this chat to work.

## What gets created on the customer side

When something is created in the Vanta portal, create it in that customer's portal only.

Customer comes from the record. If the record has no customer, do not send it.

Send everything except an inspected tool.

An inspection tool and an inspected tool are the same record. Those stay on the Vanta side for review. After review, they go out through the existing API. They are not part of this automatic create.

Do not update or delete a customer row from this rule. This rule is create only. If that row is already in the customer portal, skip it. Do not overwrite it.

## What this update must not do

- Do not push from the design site.
- Do not point a customer portal at the Vanta database.
- Do not let one customer read or message another customer.
- Do not send an inspected tool until it has been reviewed and sent through the API.