About Korelex

What we test

Models and endpoints, RAG pipelines and the data behind them, agents, and the tool graphs those agents call. We work from an ordinary user's seat, under written authorization, against systems already running in production.

Every claim is reproduced on a second run before it is written down. Findings are mapped, per finding, to the OWASP LLM Top 10, MITRE ATLAS, the EU AI Act, GDPR, the RBI's 2025 FREE-AI framework and India's DPDPA. What held is published alongside what broke, so a client knows what not to regress.

Who we work with

Regulated financial institutions in India and cross-border, and the AI vendors selling into them. Both arrive with the same problem: an AI system already in production, and a reviewer who wants proof rather than a policy document.

Why independent

Korelex does not build models, and does not sell the remediation for what it finds. A tester who also sells you the fix has a commercial reason to find something. We sell neither — which is what makes a finding worth acting on.

The company

Korelex is the assurance practice of Vaultmark Private Limited, registered in Karnataka and working from Bengaluru. Five people, six engagements completed. The founder, Manish Goyal, built identity and data-governance systems at Amazon, Microsoft and VMware before he started testing them.