Security

How Veredis handles your data

A compliance platform is asking to see your trade documents — invoices, purchase orders, shipment records. Here is what actually happens to that data, plainly stated.

Document handling and retention

Scan History saves operational metadata rather than new full result copies. Structured decision evidence is retained separately for audit. Cross-scan observations use entity digests; Radar stores the names and identifiers selected for monitoring. Historical records and temporary processing storage have separate retention requirements described in our Privacy Policy.

Uploaded files and free-text inputs are treated as sensitive at every processing step
Scan History excludes new report content, extracted text, product descriptions and routes
Operational history is separate from the structured decision audit
Temporary storage and backup retention must be verified for each deployment

Access control

Application data is scoped to the organization account it belongs to, and access requires authentication — Veredis does not rely on client-side hiding as an access-control mechanism. Role-based permissions distinguish standard users, administrators, and enterprise account roles.

Multi-tenant SaaS access control is an area we treat as continuously reviewed rather than a solved, static property — if you identify an access-control issue, see "Reporting a vulnerability" below.

Decision-record integrity

Compliance decisions are recorded as structured audit metadata — source versions, timestamps, entity identifiers, and the rule path that produced the outcome — rather than as free-text narrative alone. Where artifact integrity matters (a decision dossier that needs to be verifiably unaltered later), records carry hash references and are signed using established cryptographic schemes, not a custom or invented scheme.

Transport and infrastructure

HTTPS/TLS in transit
Secrets (API keys, signing keys, provider credentials) are held in environment/secrets configuration, never hardcoded in source or exposed to client-side code
Separate credentials and environments are maintained across development, UAT, and production

Reporting a vulnerability

If you believe you've found a security issue, please report it to security@veredisai.com rather than filing a public issue. A machine-readable disclosure policy is published at /.well-known/security.txt per RFC 9116.

See the Privacy Policy for how personal data specifically is handled, and AI Trade Compliance Software for how decision evidence is structured.