VSys generally requires SELECT, UPDATE, INSERT and DELETE privileges on its tables. One major exception is the "trace" table. Only one tool in VSys ever deletes records from this table, the Purge old trace records tool, and no tools update any records in this table. To enhance the security of the trace logs you can prevent VSys from running that operation by revoking the DELETE and UPDATE privileges of VSys users at the database level, leaving them only SELECT and INSERT privileges.
VSys still requires READ and INSERT privileges even if tracing is disabled (it stores some minor information there like reminder notifications being sent).