Trust center

Compliance status

Vericto produces evidence for your organization's SOC 2 and ISO 27001 controls (see Compliance), but that is not a Vericto certification. If your vendor review needs more information, write to security@vericto.com.

Data and architecture

• Vericto never stores the results of your queries: only the query text, the decision metadata and the AST node that triggered it.
• The proxy runs in your infrastructure and opens the connection to your database: Vericto neither receives nor stores your connection string.
• The text of each query in the audit trail is encrypted with AES-256-GCM. API keys are stored as a SHA-256 hash and passwords with bcrypt.
• TLS 1.2 or higher on every HTTP connection and on the proxy's, and HSTS on every Vericto domain.
• The platform runs in AWS us-east-1, across several availability zones. Enterprise Enhanced and Premium offer a dedicated deployment in the AWS region you choose.

• Security: zero-trust architecture, data flow and encryption
• Docs: telemetry privacy

Privacy and sub-processors

• The DPA is part of the Terms of Service and is published, also as a PDF.
• The list of sub-processors, with the service, the data and the location of each, is in Annex III of the DPA. Vericto gives at least 30 days' notice before adding or replacing one.
• On the plans with shared infrastructure (Free, Builder, Team and Enterprise Standard), Vericto does not guarantee that data is processed in a particular region or country.

• Data Processing Agreement (DPA)
• Privacy policy
• Cookie policy

Access and audit

• RBAC with four roles (owner, admin, member and viewer) and CI API keys with narrow scopes, or OIDC from GitHub Actions.
• Enterprise SSO and a log of every administrative change, with the actor, the IP and the before and after.
• Audit trail exports and the compliance report are signed with Ed25519, and you can verify the signature yourself.

• Docs: enterprise SSO
• Docs: administrative audit log
• Docs: verify reports

Availability and support

• The status page publishes the services Vericto operates and the incident history.
• SLA by plan: 99.5% on Builder, 99.9% on Team and Enterprise Standard, 99.95% on Enterprise Enhanced and 99.99% on Enterprise Premium.

• System status
• Support policy

Software and policies

• The rule engine, the proxy and the CLI are source-available on GitHub under the Elastic License 2.0 (ELv2): you can read the code that evaluates your queries.
• Penetration test on demand, not included in any plan: an external firm tests the API and the dashboard (and, on Enhanced and Premium, the dedicated deployment), with one retest and an attestation letter, which is not a certification. Scope and price are on the Enterprise page.
• Every CLI release publishes SHA-256 checksums and, since v1.5.1, Sigstore build attestations that tie it to the repository and the commit.
• Vericto keeps internal policies for information security, access control, change management, business continuity, data classification and retention, encryption and key management, incident response, risk and vendors. If your vendor review needs them, write to security@vericto.com.

• Source-available code (ELv2)
• Changelog

Report a vulnerability

Write to security@vericto.com. We reply in under 48 hours, ship the fix for a critical vulnerability in under 30 days, and take no legal action against anyone who reports in good faith. The details are on the security page.