Privacy Policy

The controller of the personal data described in this policy is Gonçalo Veríssimo Unipessoal LDA, a single-member private limited company (sociedade unipessoal por quotas) trading as Verixian, with registered office at Rua dos Camponeses, nº 23, 2925-108 Azeitão, Portugal, registered with the Portuguese Commercial Registry under the single registration and tax number (NIPC) 518949729, with a share capital of €1,000. Email: geral@verixian.com.

When we deliver our services, we process the personal data found in the systems we test, in the code we check and in exposure-monitoring results on behalf of the client organization concerned, as its processor, under a data processing agreement. That organization is the controller of that data (see 'Engagement and exposure-monitoring data' and 'Code monitoring data' below).

When you request an engagement through the contact form, we collect your name, work email address and company, your answers to the questions on the form (what you would like assessed and when you would like to start) and, if you choose to give them, your phone number and country code. We need everything except the phone number to reply to your request.

When you request the brochure through the brochure request form, we collect your name, work email address and company. We use them to provide the brochure and to reply about your request.

When you apply through the careers page, we collect your name and email address, what you tell us about your experience and, if you choose to give them, where you are based, your main area of experience and the links you share, such as a professional profile, a code repository, write-ups or your CV. Your name, email and the description of your experience are needed to apply; the rest is optional.

We look at the pages those links point to only to consider your application. Please leave out client names and anything confidential, and do not include sensitive information such as health data.

If you use the client portal, we process the account details needed to sign you in securely, such as your name, email address, the organization you belong to and your role in its portal, and we keep a record of which portal resources you access, for security.

Testing the systems a client organization authorizes can bring us into contact with personal data held in them, such as user accounts. Our dark-web exposure monitoring checks known data breaches and leaks, infostealer logs and posts on dark-web forums and marketplaces against the identifiers the client organization shares with us, such as its domains, key accounts and company and brand names. Its results can include the email addresses, usernames, password hashes, session cookies and other account details of people who hold accounts with that organization, including its staff and the customers who sign in to its services.

We process this data only on behalf of the client organization concerned, and only to report the exposure to it so it can protect the people affected. Identifiers are masked in the client portal, exposed passwords and other secrets are never shown in plaintext, and each organization sees only its own results. If you believe your data appears in these results, you can contact the organization concerned, or write to us and we will pass your request on.

When a client organization connects a repository, we receive its source code and the information attached to each change, such as the names and email addresses of the people who wrote a commit or opened a pull request. Source code can also contain personal data that developers placed in it.

We check the code in a temporary workspace that is destroyed when the check ends, and we do not store source code. We keep the findings, which name the repository, file and line and can name the author of the change. Secrets found in code are masked wherever we show them. We process this data only on behalf of the client organization concerned.

When you visit the website, our hosting provider processes technical data such as your IP address and browser details to deliver the site and keep it secure. The verification check on our forms processes similar technical data to tell people apart from automated traffic. We do not use analytics.

We use the information described above to respond to your request and to discuss, scope, set up and deliver an engagement; to consider your job application and contact you about it; to check the code in the repositories your organization connects and report what we find; to sign you in to the client portal and show you only your organization’s results; and to keep the website and the client portal secure. We do not use your information for automated decision-making, and we do not sell it.

We process engagement requests and brochure requests to take steps at your request before entering into a contract, and on the basis of our legitimate interest in responding to enquiries about the Service (Article 6(1)(b) and 6(1)(f) GDPR).

We process job applications to take steps at your request before possibly entering into an employment or service contract with you, and on the basis of our legitimate interest in considering your application for roles that open while we keep it (Article 6(1)(b) and 6(1)(f) GDPR).

We process portal account details, access records and website technical data, and run the verification check on our forms, on the basis of our legitimate interest in providing the Service to your organization and keeping it secure (Article 6(1)(f) GDPR).

We process engagement, code-monitoring and exposure-monitoring data as a processor, on the instructions of the client organization concerned and under our data processing agreement with it (Article 28 GDPR).

We share personal data only with the providers that operate the website and the client portal on our behalf: Vercel (hosting and content delivery), Formspree (delivering the contact, brochure request and job application forms to us), Cloudflare Turnstile (checking that form submissions come from a person), Clerk (client portal sign-in and account management) and Supabase (storage of client portal data).

To deliver engagements and code monitoring we also use providers of AI model inference and of breach-exposure intelligence, which process engagement and code-monitoring data only on our instructions, and we connect to the code host your organization uses. All of these providers are listed by category on our Trust page, and by name in our data processing agreement. We may also disclose personal data where the law requires it, for example to a court or another competent authority.

Engagement data, including code findings and exposure-monitoring results, is stored in the European Union. Some of the providers that operate the website and its forms process data outside the European Economic Area. Where that happens, personal data is protected by an appropriate safeguard under Chapter V of the GDPR, such as an adequacy decision or the European Commission standard contractual clauses.

Engagement and brochure requests: if your request does not lead to an engagement, we delete it 12 months after our last contact with you. If it does, we keep your contact details for as long as we work with your organization.

Job applications: we keep your application for 12 months from the date you send it, so we can consider you for roles that open in that time, and then delete it.

Client portal and engagement data: portal account details and access records, engagement data, code findings and exposure-monitoring results are deleted 90 days after your organization’s subscription ends, or sooner if it asks. Source code is not stored.

Website technical data is kept by our hosting and form-verification providers only for a limited period, for security and operations. These periods include the copies held by our providers and in our email. You can ask us to delete your data sooner, and we keep it longer only where the law requires it.

We use appropriate technical and organizational measures to protect personal data, described on our Trust page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Under the GDPR you have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. Where we rely on our legitimate interest, you can object at any time. To exercise these rights, contact geral@verixian.com.

Where we process your data on behalf of a client organization, we will pass your request to that organization and help it respond.

You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt).

The Nemesis website does not use advertising or cross-site tracking cookies, and it does not use analytics. Any cookies set are strictly necessary for the site to operate, such as the security cookie the verification check on our forms may set, and the cookies our sign-in provider uses to keep you signed in to the client portal.

The website is not directed to children, and we do not knowingly collect their personal information.

We may update this policy from time to time. The version in force is the one shown at the top of this page.

Questions about this policy, or requests regarding your information, can be sent to geral@verixian.com.