Enterprise-grade security and compliance
VerifyAI is undergoing a SOC 2 Type II audit and runs on SOC 2 / ISO 27001 infrastructure. We offer a standard Data Processing Addendum for customers with UK or EU data protection obligations. The controls below answer the questions our enterprise customers ask before signing.
Certifications and alignment
We are undergoing a SOC 2 Type II audit against the AICPA Trust Services Criteria, with a standard Data Processing Addendum available for customers with UK/EU GDPR or CCPA privacy review requirements.
SOC 2 Type II
Independent audit of our security, availability, and confidentiality controls is currently in progress. Status updates and our security overview are available under NDA.
AICPA Trust Services Criteria — audit in progress
Built on compliant infrastructure
VerifyAI runs on enterprise infrastructure with the compliance programs shown below. These provider audits reinforce the SOC 2 controls we are implementing across the stack.
Vercel
Application hosting and edge delivery
- SOC 2 Type II
- ISO 27001
- PCI DSS Level 1
- DPA and SCCs available
Supabase
Database, authentication, storage
- SOC 2 Type II
- HIPAA-eligible infrastructure
- DPA and SCCs available
Google Cloud
Compute, image storage, ML inference
- SOC 1 / 2 / 3
- ISO 27001 / 27017 / 27018
- HIPAA-eligible services
Encryption
Modern transport security, strong at-rest encryption, and documented key management.
TLS 1.3 in transit
AES-256 at rest
Key rotation
Data residency and transfers
Pick the region that matches your regulatory posture. New accounts default to the United States.
Regions
Where verification data is processed and stored
Transfer mechanisms
For restricted transfers under UK and EU GDPR
When personal data is transferred outside the UK or EEA, we rely on Standard Contractual Clauses (SCCs) and, for UK transfers, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs.
Transfer impact assessment information is provided alongside the DPA on request.
Access controls
Identity, authentication, and authorization built for enterprise teams.
SSO / SAML
MFA for every account
Role-based access control
Audit logs
Vulnerability management
Continuous scanning, annual third-party testing, and a clear path for outside researchers.
Continuous dependency scanning
Annual penetration testing
Responsible disclosure
Incident response
Defined severity levels, response SLAs, and breach notification commitments.
72-hour breach notification
Sev-1 acknowledgement within 1 hour
Incident communications
We notify affected customers directly during material incidents and provide post-incident summaries for enterprise security reviews.
Business continuity
Tested backups and documented recovery objectives.
Backup RPO: 24 hours
Maximum acceptable data loss window
Recovery RTO: 4 hours
Target time to restore production service
Privacy
Minimum necessary data, configurable retention, and clear processor commitments.
90-day default image retention
Data subject rights
DPA available
Read our GDPR overview for a deeper walkthrough of controller / processor responsibilities and data subject rights.
Resources
Documents and evidence available for your security review.
SOC 2 audit status
Type II audit in progress — request status update under NDA
DPA and security questionnaires
Request our DPA, security overview, or pre-filled questionnaire responses from our team
Need details for an enterprise security review?
We'll walk through our controls, share evidence under NDA, and answer questionnaire-style follow-ups directly.