We handle sensitive due diligence data. Here is exactly how we protect it — no marketing language, just the actual controls we have in place.
All communication between your browser and Verafy servers is encrypted using TLS 1.2+. No data is ever sent over unencrypted connections.
All data is stored in Neon PostgreSQL with encryption at rest. Backups are also encrypted.
Passwords are hashed using bcrypt with a work factor of 12. We never store plaintext passwords. Password reset tokens expire after 1 hour and are single-use.
Short-lived JWT tokens (7-day expiry) are used for session management. Tokens are validated server-side on every request.
Each user's CRM pipeline data is logically isolated in the database using user-scoped keys. No user can access another user's deal data.
API hosted on Render (SOC 2 Type II). Frontend hosted on Vercel (SOC 2 Type II). Database hosted on Neon with point-in-time recovery.
All key user actions — searches, profile views, logins, exports — are logged with timestamp, user identity, and IP address for compliance and incident response.
Programmatic API access uses SHA-256 hashed API keys prefixed with vfy_. Keys can be revoked instantly from the settings page.
Verafy aggregates publicly available data from UK Companies House. We do not purchase, scrape, or process private data. The following third-party providers are used in the delivery of our service:
Neon
PostgreSQL database
Render
API server hosting
Vercel
Frontend hosting
Stripe
Payment processing
Items we are actively working toward:
If you discover a security vulnerability, please disclose it responsibly. We aim to respond within 24 hours and will credit researchers who report valid issues.