Security

How Veredis handles your data

A compliance platform is asking to see your trade documents — invoices, purchase orders, shipment records. Here is what actually happens to that data, plainly stated.

Document handling and retention

Veredis's default posture is to extract the minimum structured fields a compliance analysis requires from an uploaded document, and not to retain the raw document, raw OCR output, or full transaction narrative as a matter of course. Where retention of source material is explicitly required for audit or regulatory defensibility, it is scoped and disclosed, not silent.

  • Uploaded files and free-text inputs are treated as sensitive at every processing step
  • Only the structured fields needed for the compliance analysis are extracted and stored
  • Raw documents, raw prompts, and full transaction descriptions are not written to application logs
  • Temporary processing storage is time-bounded rather than indefinite

Access control

Application data is scoped to the organization account it belongs to, and access requires authentication — Veredis does not rely on client-side hiding as an access-control mechanism. Role-based permissions distinguish standard users, administrators, and enterprise account roles.

Multi-tenant SaaS access control is an area we treat as continuously reviewed rather than a solved, static property — if you identify an access-control issue, see "Reporting a vulnerability" below.

Decision-record integrity

Compliance decisions are recorded as structured audit metadata — source versions, timestamps, entity identifiers, and the rule path that produced the outcome — rather than as free-text narrative alone. Where artifact integrity matters (a decision dossier that needs to be verifiably unaltered later), records carry hash references and are signed using established cryptographic schemes, not a custom or invented scheme.

Transport and infrastructure

  • HTTPS/TLS in transit
  • Secrets (API keys, signing keys, provider credentials) are held in environment/secrets configuration, never hardcoded in source or exposed to client-side code
  • Separate credentials and environments are maintained across development, UAT, and production

Reporting a vulnerability

If you believe you've found a security issue, please report it to security@veredisai.com rather than filing a public issue. A machine-readable disclosure policy is published at /.well-known/security.txt per RFC 9116.

Related

See the Privacy Policy for how personal data specifically is handled, and AI Trade Compliance Software for how decision evidence is structured.