Trust Center
Security, privacy and verification integrity.
VERYFY holds evidence about people’s careers and tells employers what it means. This page sets out the controls behind that, what we have completed, and what is still in progress.
Status
All systems operational. No open security incidents.
Last reviewed 18 September 2026
Compliance
Where we stand, stated plainly.
We publish status honestly, including what is not finished. Nothing here is claimed before it is true.
SOC 2 Type II
In progressObservation window underway. Report available to customers on completion.
UK GDPR & EU GDPR
AlignedLawful basis, data subject rights and retention schedules documented and operating.
ISO 27001
PlannedScoped for the next audit cycle. Controls mapped against the standard today.
Annual penetration test
CertifiedIndependent third-party test completed annually. Summary available under NDA.
Controls
What is actually in place.
Grouped by area. Expand any group to see the individual controls and how they operate.
- Encryption in transit and at restTLS 1.2+ for all traffic. AES-256 for stored evidence and verification records.
- Evidence is never sold or licensedEvidence is not sold, licensed, or used to train third-party models. It exists to support the capability profile it belongs to.
- Source documents are not republishedWhere a document supports a verification, the outcome is published — the underlying document is not exposed to employers.
- Defined retention and deletionAccount deletion removes the profile, evidence and verification history within 30 days, excluding records we must retain by law.
- Least privilege by defaultAccess to verification records is limited to the team performing checks and is reviewed quarterly.
- SSO and MFA enforced internallyAll internal systems require single sign-on with multi-factor authentication.
- Access loggingEvery access to a verification record is logged with actor, time and reason, and retained for audit.
- Offboarding within 24 hoursAccess is revoked across all systems within one working day of departure.
- Peer-reviewed change managementAll production changes are reviewed, tested and traceable to an approved change.
- Dependency and vulnerability scanningAutomated scanning on every build, with defined remediation windows by severity.
- Isolated environmentsProduction is separated from development and test. Live evidence is never copied into test environments.
- Continuous monitoring and alertingInfrastructure and application telemetry monitored with on-call escalation.
- No verification without evidenceA capability cannot be marked VERYFY'D on self-assertion. Evidence must exist and be checked.
- Method recorded against every claimThe verification method used — employer confirmation, work review, credential check, or reviewed Work — is recorded.
- Unverifiable claims stay unverifiedWhere evidence cannot be substantiated, the claim remains visibly unverified rather than being quietly approved.
- Appeals and correctionsProfessionals can contest a verification outcome and request review by a second reviewer.
- Agents organise evidence — they never create itNo agent can mark a capability or a piece of work VERYFY'D. Verification remains a human decision by the employer who reviewed the work.
- No agent makes a decision about a personAgents can search, rank, draft, evaluate, interview and recommend. They cannot reject a candidate, decide a hire, or progress anyone past shortlist on their own.
- Professional controls bind the agentsA hidden profile is never sourced. A professional not open to being contacted is never invited to an assessment or a screening interview.
- Disclosure at the point of contactAssessment invitations state that the challenge was drafted by an agent and approved by the employer. Screening interviews state plainly that the interviewer is AI and where responses go.
- Every conclusion is traceableAgent output cites the specific capability, evidence item or submission behind it, with a confidence level. An agent that lacks evidence says so rather than forcing a conclusion.
- Declining AI screening is not penalisedProfessionals can request a human conversation instead. It is not recorded as a withdrawal.
- Background checks on staffAll employees with access to personal data are screened before access is granted.
- Annual security trainingSecurity and data protection training on joining and annually thereafter.
- Documented incident responseDefined severity levels, escalation path and notification commitments for affected parties.
- Vendor review before onboardingSubprocessors are reviewed for security and data protection before any data flows.
Documents
Evidence of our own.
- Privacy policyHow personal data is collected, used and retained.Public
- Terms of serviceThe agreement covering use of VERYFY.Public
- Subprocessor listThird parties that may process personal data.Public
- Penetration test summaryLatest independent test and remediation status.Under NDA
- SOC 2 Type II reportAvailable to customers once the current window closes.Under NDA
- Information security policyInternal control framework and standards.On request
- Data processing agreementStandard DPA for employer customers.On request
- Incident response planSeverity model, escalation and notification.On request
Documents marked on request or under NDA are shared with customers and prospects through our team. Request access.
Subprocessors
Third parties that may process data.
- Cloud hosting providerApplication hosting and database storageEU / UK
- Object storage providerStorage of evidence filesEU / UK
- Email delivery providerTransactional and notification emailEU / US
- Error and performance monitoringApplication telemetryEU
- Payment processorSubscription billingEU / US
- Customer support platformSupport conversationsEU
Customers are notified before a new subprocessor with access to personal data is added.
Questions
The ones we are asked most.
Only who the professional allows. Profiles can be set to link-only, matched employers only, or hidden entirely, and individual items can be withheld from the profile.
No. Evidence is not sold, licensed, or used to train third-party models. Subprocessors listed on this page process data only to operate the service.
That evidence was supplied for the claim and checked using a method appropriate to it, and that the method is recorded. It is a substantiated signal, not a prediction of future performance.
Primary storage is in the UK and EU. Where a subprocessor operates outside that region, transfers are covered by standard contractual clauses.
Email security@veryfy.com. We acknowledge reports within two working days and will not pursue action against good-faith research.