Security Overview

Security at Verafy

We handle sensitive due diligence data. Here is exactly how we protect it — no marketing language, just the actual controls we have in place.

Encryption in Transit

Implemented

All communication between your browser and Verafy servers is encrypted using TLS 1.2+. No data is ever sent over unencrypted connections.

Encryption at Rest

Implemented

All data is stored in Neon PostgreSQL with encryption at rest. Backups are also encrypted.

Password Security

Implemented

Passwords are hashed using bcrypt with a work factor of 12. We never store plaintext passwords. Password reset tokens expire after 1 hour and are single-use.

Authentication

Implemented

Short-lived JWT tokens (7-day expiry) are used for session management. Tokens are validated server-side on every request.

Per-User Data Isolation

Implemented

Each user's CRM pipeline data is logically isolated in the database using user-scoped keys. No user can access another user's deal data.

Infrastructure

Implemented

API hosted on Render (SOC 2 Type II). Frontend hosted on Vercel (SOC 2 Type II). Database hosted on Neon with point-in-time recovery.

Audit Logging

Implemented

All key user actions — searches, profile views, logins, exports — are logged with timestamp, user identity, and IP address for compliance and incident response.

API Key Authentication

Implemented

Programmatic API access uses SHA-256 hashed API keys prefixed with vfy_. Keys can be revoked instantly from the settings page.

Data Sources & Third Parties

Verafy aggregates publicly available data from UK Companies House. We do not purchase, scrape, or process private data. The following third-party providers are used in the delivery of our service:

Neon

PostgreSQL database

SOC 2 Type II

Render

API server hosting

SOC 2 Type II

Vercel

Frontend hosting

SOC 2 Type II

Stripe

Payment processing

PCI DSS Level 1

On Our Security Roadmap

Items we are actively working toward:

  • SOC 2 Type I audit (in planning, Q4 2026)
  • SSO / SAML 2.0 support for enterprise customers
  • Annual third-party penetration test
  • ISO 27001 certification (2027 target)

Report a Security Issue

If you discover a security vulnerability, please disclose it responsibly. We aim to respond within 24 hours and will credit researchers who report valid issues.