Trust is the product.
A verification is only worth something if you can trust how it was made. Here's how we verify, protect your data and use AI, and what we'll never do.
Where we stand today.
We'd rather tell you exactly where we are than round up.
Lawful basis, data subject rights and retention schedules are documented and operating.
Run every year by an independent third party. Summary available under NDA.
The observation window is underway. The report will be shared with customers when it's complete.
Planned for the next audit cycle. Our controls are already mapped to the standard.
What “VERYFY'D” actually means.
VERYFY'D means evidence was supplied and checked in a suitable way, and how it was checked is recorded. It confirms past work. It doesn't predict how someone will perform in future.
The four states
Trace a claim
Pick a claim to see its full record, step by step.
- Claim addedTolu Adeyemi · 3 Mar 2026
- Request sent to Hannah ClarkeHead of Design · 3 Mar 2026
- Evidence reviewedFigma file and launch notes · 5 Mar 2026
- Confirmed · Manager StampSigned by Hannah Clarke · 5 Mar 2026
Disagreements happen in the open.
When an employer says a claim is wrong, it's shown on the profile as Disputed, without blame. This protects honest professionals, because it makes false claims pointless.
Your evidence belongs to you.
How we protect the record.
Data protection
- TLS 1.2+ for all traffic. AES-256 for stored evidence and verification records.
- Source documents are never republished.
- Live evidence is never copied into test environments.
Access control
- Least-privilege access to verification records, limited to the team doing checks and reviewed quarterly.
- SSO and MFA required on all internal systems.
- Every access to a verification record is logged with who, when and why.
- Access is revoked everywhere within one working day of someone leaving.
Product security
- Every production change is reviewed, tested and traced to an approved change.
- Automated dependency and vulnerability scanning on every build, with fix windows set by severity.
- Production is separated from development and test.
- Infrastructure and application monitoring, with on-call escalation.
People & process
- Staff with access to personal data are background-checked first.
- Security and data protection training on joining and every year.
- A documented incident response plan with severity levels and notification commitments.
- Subprocessors are reviewed before any data reaches them.
AI helps. It never decides about people.
Agents organise evidence, never create it
They can't mark anything as VERYFY'D. Verification is a human decision by the employer who reviewed the work.
Agents don't decide about people
They can search, rank, draft, assess, interview and recommend. They can't reject anyone, make a hire or move someone forward without a person approving it.
Your settings apply to agents
Hidden profiles are never sourced. If you're not open to contact, agents won't invite you to assessments or screening.
Always disclosed
Invitations say when an agent drafted a work brief. Screening interviews say the interviewer is AI and where your answers go.
Every suggestion shows its proof
EveryAI suggestionshows the proof behind it and how confident it is. When there's little proof, it says so.
Opting out costs nothing
Ask for a human conversation instead. It's never held against you.
Who helps us run VERYFY.
They process data only to operate the service. We tell customers before adding any new subprocessor with access to personal data.
| Provider type | Purpose | Region |
|---|---|---|
| Cloud hosting | Application hosting and database storage | EU / UK |
| Object storage | Evidence files | EU / UK |
| Email delivery | Transactional and notification email | EU / US |
| Error and performance monitoring | Application telemetry | EU |
| Payment processor | Subscription billing | EU / US |
| Customer support platform | Support conversations | EU |
Policies and reports.
Documents on request or under NDA are shared through our team. Contact us
Found something? Tell us.
We acknowledge vulnerability reports within two working days, and we won't pursue good-faith security research.
security@veryfy.comprivacy@veryfy.comstatus@veryfy.com