Trust centre
Every agent action
routes through us.
This page covers what we have built, what we have not built yet, and every third party that touches your data.
Security posture
Controls in place today
Per-account data isolation
Every policy, evaluation and audit record is scoped to the owning account and filtered at the database query level, not only in application code. Row-level security is enabled on customer tables.
API keys stored as hashes
Keys are persisted as SHA-256 hashes and shown in plaintext exactly once, at creation. A database read cannot yield a usable key. Keys can be revoked immediately and revocation is checked on every request.
Encryption in transit
All API and dashboard traffic is served over TLS. There is no unencrypted path to evaluation data.
Encryption at rest
Database storage and backups are encrypted at rest by our infrastructure provider (AES-256).
Append-only audit log
Every decision is written as an immutable audit record with the full evaluation trace. Records are exportable at any time and are never edited in place.
Escalation approval integrity
Approve/reject links carry single-use tokens stored as hashes, scoped to one decision on one escalation, and expiring with the escalation window. A replayed link cannot change a decision.
Least-privilege service access
The dashboard operates under the caller's own credentials. Elevated service access is confined to the runtime evaluation path, which needs to write records on the customer's behalf.
Not in place yet
If one of these is a hard requirement for you, tell us - it moves our roadmap.
SOC 2 Type II
Not yet held, and no observation period has started. The report and auditor will be published here. Verdicter produces SOC 2 evidence for your audit today - a separate thing from being certified ourselves.
Third-party penetration test
No independent pen test has been completed. When one is, the summary letter will be published on this page.
Independent uptime probing
Latency is measured and published on our status page. Availability is not yet measured by an external prober, so we do not publish an uptime figure.
Your data
What we hold, and for how long
What we store
The tool name, the arguments you send to evaluate(), the decision, the risk score, and the evaluation trace. That is the audit log - it is the product.
How long we keep it
Retention follows your plan: 7 days on Hobby, 30 on Starter, 90 on Pro, and negotiated on Enterprise. Delete your account and the associated records go with it.
What we never do
We do not train models on your data, we do not sell it, and we do not share it with any party outside the subprocessors listed above.
Minimising what you send
Verdicter only needs enough of a payload to decide. If a field is not referenced by a policy, redact it before you call evaluate() - the cleanest way to protect data is not to transmit it.
Subprocessors
Everyone else who touches it
The complete list. We will publish changes here before they take effect.
Customer data - policies, evaluations and audit records - is stored in Australia (AWS ap-southeast-2) and processed by compute in the same region. Static assets are served from a global CDN, which carries no customer data.
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Managed Postgres, authentication, storage | All customer data | Australia (ap-southeast-2) |
| Vercel | Application hosting and edge delivery | Request metadata, logs | Compute: Australia (syd1) · CDN: global |
| Stripe | Payments and subscription billing | Billing contact, payment method | Global |
Responsible disclosure
Found something? Tell us.
Email security@verdicter.dev with enough detail to reproduce. We will acknowledge within one business day and keep you updated until it is closed.
Acknowledgement
Within 1 business day.
Triage and severity
Within 3 business days, with our assessment shared back to you.
Fix and credit
Critical issues patched as a priority. We credit reporters publicly unless you would rather we did not.
Please do not run automated scanners against production, access data that is not yours, or degrade service for other customers. Good-faith research within those bounds will never result in legal action from us.
Security review pack
Doing vendor due diligence? Ask and we will send our architecture overview, data-flow diagram, and answers to your questionnaire. We do not gate this behind a sales process.
Request the packLatency
Verdicter sits in your hot path, so our latency is your latency. A full API call completes in 23ms at the median and 36ms at p95, including authentication, policy fetch, the decision and the audit write.