VATES - 2026 Pricing, Features, Reviews & Alternatives

VATES is embeddable AI infrastructure for businesses. It answers questions from your own material — as a widget on your site, as a standalone chat page, or through an API you build on, the way you would build on Stripe or Twilio. Both modes share one foundation.

How knowledge is held

Knowledge is stored as structured plain text and interpreted at the moment a question is asked. There is no embedding step, no vector index and no re-ranking stage. Writing a line takes effect immediately — there is no re-embedding or re-indexing job between an edit and the answer that reflects it. Because the store is plain text rather than numeric vectors, you can open it, read exactly what the system holds, trace which entries an answer drew on, and delete an entry and verify by inspection that it is gone.

The practical consequence is a shorter dependency list: no dedicated vector database to operate, no GPU, and no embedding API billed per request.

Architecture

Three working roles. Content is composed from natural language, images and PDFs into structured entries. A management interface handles full-scan search, log analysis and reference tracing. The conversational layer answers against the knowledge base, in the language the question was asked in.

Integration

REST API with optional idempotency keys on all state-changing requests — retrying with the same key replays the original response, and the same key with a different body is rejected. Rate limits are applied per tenant on usage endpoints and per IP on authentication endpoints, with rate-limit headers returned so clients can self-throttle. Authentication is by API key for server-side access, or by origin allowlist for browser widgets.

A remote MCP server lets external AI agents query an authorized knowledge base. Connection is by OAuth as a custom connector, or by bearer API key for clients without connector support. One tool is exposed and it is read-only: it cannot alter settings, read conversation logs, or reach other instances. Access is revocable at any time, and usage through MCP is metered exactly like normal traffic under the same per-instance limits.

Security

Hash-chained tamper-evident audit logs across ten categories, searchable and exportable as CSV with the hash included. Passkeys (WebAuthn/FIDO2) and two-factor authentication. JWT sessions with a revocation ledger. Per-customer IP allowlists and denylists in CIDR notation, denylist taking precedence. GeoIP detection of logins from unusual locations. Configurable alerts for low balance, new-location sign-in, blocked access and repeated failures. Encrypted daily backups with generational retention. Per-instance caps on request size, request rate, concurrent sessions, context length and response tokens, as a defense against runaway consumption.

An automated data lifecycle governs retention: active, suspended, logically deleted, pseudonymized, physically deleted. Seventeen data categories each carry their own retention period, selected against the strictest applicable standard across jurisdictions.

Operations

The console covers everything — instance settings, the knowledge base, usage, billing and security — and is built to work fully on a phone. Answers are returned in the reader's own language; the console, documentation and website are localized into 23 languages across nine writing systems, including full right-to-left support.

Pricing is a prepaid deposit: no subscription, no monthly fee, no minimum spend. Usage is deducted from the balance, minimum top-up USD 5.00.

Built and operated by STANDOUT Inc., Okayama, Japan.