https://verificate.ai/_next/static/chunks/pages/security-38b46c9768536077.js

1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[8338],{2916:(e,t,a)=>{"use strict";a.d(t,{P$:()=>n,eB:()=>d,vM:()=>o});var i=a(7876),r=a(1298),s=a(8558);function n(e){let{eyebrow:t,title:a,intro:n,updated:d,path:o,description:c,noindex:l,children:h}=e;return(0,i.jsxs)("div",{className:"bg-[#080A08] text-white/85 min-h-screen antialiased",children:[(0,i.jsx)(s.A,{title:"".concat(a," — Verificate"),path:o,description:c,noindex:l}),(0,i.jsx)(r.Nv,{}),(0,i.jsxs)(r.wn,{className:"pt-28 sm:pt-36 pb-24 max-w-3xl",children:[(0,i.jsx)(r.YZ,{children:t}),(0,i.jsx)("h1",{className:"mt-6 text-3xl sm:text-4xl font-bold tracking-tight text-white leading-tight",children:a}),n&&(0,i.jsx)("p",{className:"mt-5 text-white/55 leading-relaxed",children:n}),h,(0,i.jsxs)("p",{className:"mt-12 text-sm text-white/40",children:["\xa9 2026 Verificate Pty Ltd \xb7 ACN 681 762 818 \xb7 Sydney, NSW, Australia",d?" \xb7 Last updated ".concat(d):""]})]})]})}function d(e){let{title:t,children:a}=e;return(0,i.jsxs)("div",{className:"mt-10",children:[(0,i.jsx)("h2",{className:"text-lg font-bold text-white",children:t}),(0,i.jsx)("div",{className:"mt-3 space-y-3 text-[15px] text-white/60 leading-relaxed",children:a})]})}function o(e){let{items:t}=e;return(0,i.jsx)("ul",{className:"space-y-2",children:t.map((e,t)=>(0,i.jsxs)("li",{className:"flex gap-3",children:[(0,i.jsx)("span",{className:"text-[#8CCB43] font-mono shrink-0",children:"—"}),(0,i.jsx)("span",{children:e})]},t))})}},5536:(e,t,a)=>{(window.__NEXT_P=window.__NEXT_P||[]).push(["/security",function(){return a(6938)}])},6938:(e,t,a)=>{"use strict";a.r(t),a.d(t,{default:()=>d});var i=a(7876),r=a(2916),s=a(1298);let n=[["Security (Common Criteria)",["TLS encryption in transit on all endpoints (edge-terminated).","Passwords stored only as one-way bcrypt hashes; short-lived signed (JWT) sessions.","Single-user API keys — per-key rate limiting and automated key-sharing (multi-IP) detection block abuse.","Least-privilege access; secrets held in the platform secret store, never in source.","No anonymous access to metered endpoints; the raw model routes are not publicly exposed."]],["Availability",["Runs on managed OpenShift with health-checked, restartable workloads and a durable, backed-up database.","Website served via a global CDN (Cloudflare) with static, cacheable assets.","Capacity and error monitoring; graceful degradation (e.g. maintenance responses) rather than hard failure."]],["Processing Integrity",["Bit-exact C++/ONNX inference — 0 / 10,000 argmax mismatches vs the reference.","Deterministic decisioning with per-decision audit lineage.","Governed proposal layer: changes are validated and gated before they can affect a live decision."]],["Confidentiality",["Data classification and access control; sensitive reports shared only under NDA.","Sovereign, zero-egress product architecture — raw data never leaves the customer boundary.","Tenant isolation; dedicated database for account and usage data."]],["Privacy",["Data minimisation and purpose limitation; cookie-free, first-party analytics with no third-party trackers.","Data-subject rights honoured under the Privacy Act 1988 and GDPR.","See our Privacy Policy for the full detail."]]];function d(){return(0,i.jsxs)(r.P$,{eyebrow:"Trust \xb7 Security",title:"Trust & Security",path:"/security",updated:"6 September 2026",description:"Verificate's security & compliance posture for enterprise: SOC 2 Trust Services Criteria and an ISO/IEC 27001:2022 control framework, AWS/Cloudflare certified infrastructure, encryption, access control, data residency (AU/US), sub-processors, DPA, GDPR/CCPA, and sovereign zero-egress architecture.",intro:"Security and sovereignty are the product. Verificate is engineered so that sensitive data and decisions stay inside your boundary. This Trust Center documents our controls, mapped to the AICPA SOC 2 Trust Services Criteria and an ISO/IEC 27001:2022 control framework — stated accurately, the way an enterprise security team would want to verify them.",children:[(0,i.jsxs)("div",{className:"mt-8 rounded-2xl border border-[#2C3D1B] bg-[#0E140A] p-6",children:[(0,i.jsx)("div",{className:"font-mono text-xs uppercase tracking-wider text-[#8CCB43]",children:"Certification status — stated plainly"}),(0,i.jsx)("p",{className:"mt-3 text-[15px] text-white/70 leading-relaxed",children:"We publish our security posture the way an enterprise security team would want to verify it — accurately."}),(0,i.jsxs)("div",{className:"mt-4 grid gap-3 sm:grid-cols-2",children:[(0,i.jsxs)("div",{className:"rounded-xl border border-white/[0.08] bg-[#0E120C] p-4",children:[(0,i.jsxs)("div",{className:"text-white font-semibold text-[14px]",children:["SOC 2 ",(0,i.jsx)(s.y0,{kind:"R"})]}),(0,i.jsxs)("p",{className:"mt-1.5 text-[13px] text-white/55 leading-relaxed",children:["Controls designed and mapped to the AICPA Trust Services Criteria; a ",(0,i.jsx)("strong",{className:"text-white/80",children:"SOC 2 Type II"})," examination is on our roadmap. We do not represent a completed attestation until a report is issued; audit status and any report are available under NDA."]})]}),(0,i.jsxs)("div",{className:"rounded-xl border border-white/[0.08] bg-[#0E120C] p-4",children:[(0,i.jsxs)("div",{className:"text-white font-semibold text-[14px]",children:["ISO/IEC 27001:2022 ",(0,i.jsx)(s.y0,{kind:"R"})]}),(0,i.jsxs)("p",{className:"mt-1.5 text-[13px] text-white/55 leading-relaxed",children:["Information security managed under an ISO/IEC 27001:2022 ",(0,i.jsx)("strong",{className:"text-white/80",children:"control framework"}),", evidence-based and independently reviewed as controls mature; formal certification is on our roadmap. We do not claim certification until an accredited certificate is issued."]})]})]}),(0,i.jsxs)("p",{className:"mt-4 text-[13px] text-white/45 leading-relaxed",children:["Our hosted service runs on ",(0,i.jsx)("strong",{className:"text-white/70",children:"AWS (Sydney region)"})," and ",(0,i.jsx)("strong",{className:"text-white/70",children:"Cloudflare"}

1)," — infrastructure that is itself independently certified to SOC 2 and ISO/IEC 27001 — and our products can run entirely inside your own boundary, on-premises or air-gapped, so the most sensitive data need never leave the building."]})]}),(0,i.jsxs)(r.eB,{title:"SOC 2 Trust Services Criteria",children:[(0,i.jsx)("p",{children:"Our controls address each of the five criteria:"}),(0,i.jsx)("div",{className:"mt-5 space-y-5",children:n.map(e=>{let[t,a]=e;return(0,i.jsxs)("div",{className:"rounded-xl border border-white/[0.08] bg-[#0E120C] p-5",children:[(0,i.jsx)("div",{className:"font-bold text-white",children:t}),(0,i.jsx)("div",{className:"mt-3",children:(0,i.jsx)(r.vM,{items:a})})]},t)})})]}),(0,i.jsxs)(r.eB,{title:"ISO/IEC 27001:2022 control framework",children:[(0,i.jsx)("p",{children:"Information security is managed under an ISO/IEC 27001:2022 control framework — a documented control matrix mapped to Annex A, operated on evidence and independently reviewed as each control matures. Coverage spans the four Annex A themes:"}),(0,i.jsx)("div",{className:"mt-5 grid gap-3 sm:grid-cols-2",children:[["Organizational","Information-security policies, asset & access management, supplier and cloud-service security, classification, incident management and continuity (A.5)."],["People","Screening, security responsibilities, awareness and access on joining, changing and leaving (A.6)."],["Physical","Secure facilities and equipment for the managed-cloud substrate; sovereign / air-gapped options remove the surface entirely (A.7)."],["Technological","Cryptography, secure development (SDLC), logging & monitoring, vulnerability & threat management, data masking, backup and secure configuration (A.8)."]].map(e=>{let[t,a]=e;return(0,i.jsxs)("div",{className:"rounded-xl border border-white/[0.08] bg-[#0E120C] p-4",children:[(0,i.jsxs)("div",{className:"text-white font-semibold text-[14px]",children:[t," controls"]}),(0,i.jsx)("p",{className:"mt-1.5 text-[13px] text-white/55 leading-relaxed",children:a})]},t)})}),(0,i.jsx)("p",{className:"mt-4 text-[13px] text-white/45",children:"A control is recorded as operating only when a named owner has attached current evidence and an independent reviewer has accepted it. Certification is on our roadmap; we do not claim it until an accredited certificate is issued."})]}),(0,i.jsx)(r.eB,{title:"Data residency & sovereignty",children:(0,i.jsxs)("p",{children:["Verificate products are CPU-native and architected for ",(0,i.jsx)("strong",{className:"text-white",children:"zero network egress"})," — they can run entirely on-premise, in your own Kubernetes/OpenShift, on a VM, or fully air-gapped, so production answers need not leave the building. Account and gateway data for the hosted service is stored ",(0,i.jsx)("strong",{className:"text-white",children:"in Australia (AWS Sydney region)"}),". Data-residency options for US and other regions are available for enterprise engagements — talk to us about your requirement."]})}),(0,i.jsx)(r.eB,{title:"Sub-processors",children:(0,i.jsxs)("p",{children:["The hosted service uses a small set of vetted providers, each independently certified to recognised standards:",(0,i.jsx)("strong",{className:"text-white",children:" Amazon Web Services"})," (compute & database, SOC 2 / ISO 27001),",(0,i.jsx)("strong",{className:"text-white",children:" Cloudflare"})," (web hosting/CDN & edge, SOC 2 / ISO 27001),",(0,i.jsx)("strong",{className:"text-white",children:" Stripe"})," (payments, PCI-DSS Level 1), and ",(0,i.jsx)("strong",{className:"text-white",children:"Resend"})," (transactional email). A current sub-processor list and a Data Processing Addendum (DPA) are available on request."]})}),(0,i.jsx)(r.eB,{title:"Responsible disclosure",children:(0,i.jsxs)("p",{children:["If you believe you have found a security vulnerability, please report it privately to"," ",(0,i.jsx)("a",{href:"mailto:[email protected]",className:"text-[#8CCB43] hover:underline",children:"[email protected]"})," with the subject “Security”. We will acknowledge your report, work with you on a fix, and credit you if you wish. Please do not publicly disclose until we have remediated."]})}),(0,i.jsx)(r.eB,{title:"Privacy & regulatory",children:(0,i.jsxs)("p",{children:["Verificate handles personal information under the Australian ",(0,i.jsx)("em",{children:"Privacy Act 1988 (Cth)"})," / Australian Privacy Principles, the EU/UK ",(0,i.jsx)("strong",{className:"text-white",children:"GDPR"}),", and the California ",(0,i.jsx)("strong",{className:"text-white",children:"CCPA/CPRA"})," where applicable. A Data Processing Addendum is available for enterprise customers. Payment processing is handled by a PCI-DSS Level 1 provider. The Verificate Gate additionally scores AI-written code against ",(0,i.jsx)("strong",{className:"text-white",children:"ISO/IEC 5055"})," and ",(0,i.jsx)("strong",{className:"text-white",children:"ISO/IEC 25010"})," — a product capability, distinct from the organisational control frameworks above. See our"," ",(0,i.jsx)("a",{href:"/privacy",className:"text-[#8CCB43] hover:underline",children:"Privacy Policy"})," and"," ",(0,i.jsx)("a",{href:"/legal",className:"text-[#8CCB43] hover:underline",children:"Legal & claims"})," pages."]})})]})}}},e=>{e.O(0,[8096,8799,636,8792],()=>e(e.s=5536)),_N_E=e.O()}]);