Trust & security
Security you can put in front of your own auditors
We assess systems for a living, so the way we run that work and handle what we find has to hold up to the same scrutiny. This is how every engagement is kept safe, and how your data is protected from the first scope call to the day it is deleted.
At a glance
- Written authorization before anything runs
- Confined to the scope you agree
- Client data hosted in the EU
- Deleted 90 days after your subscription ends
Every engagement
Safety built into every stage
The same safeguards apply to every engagement, from the moment you authorize it to the moment results reach you.
01Authorize
Authorized in writing
An engagement starts only after you authorize it in writing. Consent is never assumed.
02Scope
Confined to your scope
Scope is agreed up front: what to assess and what to leave out. Activity is confined to it.
03Run
Isolated and supervised
Each engagement runs in its own environment, discarded when the work ends, with an operator watching throughout.
04Verify
Independently verified
A finding is reported only after a separate step has re-proven it. Nothing confirms its own result.
05Deliver
Delivered privately
Results reach you only through your organization’s portal, with sensitive values masked.
Your data
How your data is protected
What we keep about your engagements, your code and your exposures, where it lives, who can see it and when it is gone.
Your source code, never stored
Code monitoring checks your code in a temporary workspace that is destroyed when the check ends. We keep the findings, never the source. The app you install can read code, post checks and comments on pull requests, and open pull requests with suggested fixes, and it never merges anything.
Hosted in the EU
Client data, including findings, the evidence behind them and your reports, is stored in the European Union.
Encrypted
Everything travels over encrypted connections, and the data delivered to your portal is encrypted at rest.
Isolated per client
Each organization’s data is kept apart in the application and again at the database, with row-level security. Your team gets read-only access to your own data.
Sensitive values masked
Credentials and personal identifiers surfaced during an engagement, and secrets found in your code, are shown in masked form, never in plaintext.
Deleted on schedule
Engagement data is permanently deleted 90 days after your subscription ends, or sooner if you ask.
Recorded
Actions taken during an engagement are recorded, and every confirmed finding is backed by the evidence that proved it.
Access and accountability
Who can see your results
Portal access
Multi-factor authentication
Every sign-in to the client portal is protected with a second factor.
Your team, your roles
Your organization invites its own people and decides who has access, with roles for admins and members.
Hardened by default
The portal is never stored in browser or shared caches, and runs under strict browser security policies.
Governance
GDPR
Verixian is a company based in the European Union and handles personal data in line with the GDPR.
Data processing agreement
Every client can sign our data processing agreement, which sets out how we process engagement data on your behalf.
Breach notification
If a security incident affects your data, we tell you without undue delay: what happened and what we are doing about it.
Sub-processors
Who else touches your data
The categories of third parties we rely on. The full named list, with entity, location and transfer basis, comes with our data processing agreement.
| Category | Purpose | Applies to |
|---|---|---|
| Hosting | Serving this website, the client portal and their APIs | Website and portal |
| Form handling | Delivering the enquiries you submit on this website | Website |
| Bot protection | Screening the website forms and sign-in for automated abuse | Website and portal |
| Authentication | Signing your team in to the client portal | Portal |
| Portal database | Storing and serving your findings and reports in the client portal | Portal |
| AI model inference | Generating analysis and reports during an engagement, and reviewing pull requests | Engagement and code monitoring |
| Code host connection | Receiving commits and pull requests from the repositories you connect, and posting checks and comments on them | Code monitoring |
| Breach-exposure intelligence | Checking your organization’s exposure in known breaches | Engagement |
Your data, your rights
Handling, retention and control
Deletion
Engagement data is deleted 90 days after your subscription ends. Ask, and we delete it sooner, including findings and the evidence behind them.
Website privacy
Personal data collected through this website is covered by our Privacy Policy and Terms.
Read the Privacy PolicyDPAs and questionnaires
For our data processing agreement, a security questionnaire, or a data-rights request, email geral@verixian.com.
geral@verixian.com
Procurement or security review
Bring your security team
into the detail
We will walk your security and procurement teams through how every engagement is run and how your data is handled, and answer your questionnaire in writing.