Data protection
Azure encryption protects stored data and connections. Key Vault holds platform secrets and keys.
Understand how VeriProof handles your data
Your security team needs facts it can check. Here is what exists today, where the service runs, and how to check our releases and your evidence without having to trust us.
Assurance status
What we can show your security team
Everything in this list exists today. Public items are linked. For the rest, send a request through the diligence form and name the deployment you plan to use.
Scroll horizontally to see all columns.
| Material | What it covers | How to get it |
|---|---|---|
| Security architecture docs | Services, trust boundaries, tenant isolation, encryption, and key handling | Public docs |
| Data-flow walkthrough | Which fields cross each boundary, from your application to stored evidence and exports | Public docs |
| Subprocessor list | Each service that may process personal data, and why | Public list |
| Data processing agreement | Processing scope, security measures, subprocessor notice, and return or deletion at exit | On request |
| Questionnaire answers | Your SIG Lite, CAIQ, or in-house questionnaire, answered for your deployment | On request |
| Source code access | Security review tier (read and inspect) for SaaS plans. The modification tier comes only with Private Enterprise. | On request |
| Release verification | Signed builds, reproducible from their commit, with a software bill of materials | How it works |
| Sample evidence pack | A sample export with its signed file inventory and proof records | Download |
| Independent verifier | Checks a pack's signature, files, and proofs without a VeriProof account | Verification guide |
| Your own testing | Your team or assessor tests the managed service under written rules of engagement | Testing rules |
| HIPAA BAA terms | Agreed for your deployment during contracting, before any ePHI is sent | HIPAA review |
Security architecture
Look at the controls behind the service
Evidence integrity
Has a record changed? Cryptographic verification lets your reviewers check recorded evidence for themselves.
Retention controls
Keep records for the period your organization needs. Retention settings and legal holds cover both deletion and preservation.
Role-based access control
Customer administrators assign six portal roles, from Developer to Auditor. Each role has its own permissions for reviewing records, managing settings, or making decisions.
Tenant isolation
Tenant-scoped authorization and queries keep each customer's records apart. Staff administration runs through separate controls.
Vulnerability management
Automated dependency and code checks run before release. Your team can also test the managed service itself under written rules of engagement.
Integrity proof for each record
Choose the proof provider for your environment
Keep verification in Azure with the default Azure SQL Database Ledger option. Need a public reference? Choose Solana when your environment is created.
Private verification in Azure
Store each session’s fingerprint in an append-only Azure SQL Database Ledger table. Verification checks the ledger against separately protected database digests to detect changes.
Your auditor gets read-only verification access, separate from the access that records evidence, and checks each fingerprint in Azure. Nothing is published to a public network.
Public verification with Solana
Publish a fingerprint for a group of records to Solana. Anyone with the reference can inspect the public transaction.
VeriProof sends fingerprints only. Decision content, personal data, and protected health information stay in your deployment; verification uses the public Solana network.
One verification option per environment
The proof provider is fixed after the environment is created. Choosing the other provider requires a new environment with its own proof history. Private Enterprise runs entirely in your own Azure subscription, integrity ledger included.
Release verification
Verify what you are running against the source it came from
VeriProof releases are signed by a protected build workflow and can be rebuilt from the commit that produced them. For Private Enterprise, the chain will continue into your own subscription. Here is each link, and what your team can check.
Built by a protected workflow from one commit
Only VeriProof's protected build workflow on the main branch produces a release, at an exact commit named in the release manifest. Each package is signed with Sigstore Cosign. The signature is bound to that workflow's identity, not to a key a person holds.
Built twice, compared, and recorded
The build runs twice from the same commit, and the package digests have to match before a candidate can be released. The manifest carries that reproducibility evidence and a CycloneDX software bill of materials.
Pinned by the template you deploy
The Marketplace template will bind installation to one signed release. The installer will verify each package signature and check a separately signed, append-only revocation feed. If either check fails, installation stops.
Recorded in your own storage
The installer will write a secret-free installation record, including the release manifest digest, to a container in your subscription. A locked retention policy protects it. That record is yours, and it says exactly what was installed.
What your team can check
Verify the manifest signature with Cosign against the build workflow's identity. Compare the package digests to your installation record, and check the signed revocation feed. None of these steps goes through VeriProof. Open the verification guide.
With source access
Check out the commit named in the manifest and rebuild it with the same pinned toolchain. Then compare digests the way the pipeline does. That is the direct test that the code you read is the code you run.
Source code for the SDKs and the platform is available on request under the standard VeriProof software license. It is not open source. The security review tier lets your team read and inspect the code, and it is available on SaaS plans. The modification tier also lets you change the code and run it in your own environment. It comes only with Private Enterprise and is set in the agreement.
Data residency
Know where your records live
The managed service runs in Azure in the United States (Central US). Managed AI features call Azure OpenAI in East US 2. Database backups are geo-redundant and stay in the United States. If you choose Solana for public proofs, only fingerprints go to that network.
Private Enterprise is coming soon to Azure Marketplace. It will run the whole platform in your own Azure subscription, in the regions you choose, completely separate from VeriProof SaaS. Your team will own and operate it, with proofs in your own Azure SQL Database Ledger. VeriProof will have no access to it. Support is set in your agreement and works from what your team chooses to share.
Services and subprocessors
Know which services receive data
Azure runs the platform. Optional AI analysis, email notices, and public proofs each have their own data flow, and the subprocessor list names every provider.
AI-assisted features may send selected fields to the configured model provider. Include those features in your data review alongside decision-record storage.
Incident response
Keep the right people informed
Affected customers hear about an incident through their designated contacts. We tell them the verified scope, the containment status, and anything they need to do.
Notice duties and timing follow the customer agreement and applicable law.
Business continuity
Plan for the records your business relies on
Recovery requirements
How soon must service return, and how much recent data could you afford to lose? Your agreement sets the recovery targets.
Evidence availability
Keep exported evidence under your own records policy. Proof verification checks integrity, and backups preserve the content needed for recovery.
Delayed proof submissions follow retry and reconciliation paths. The tamper-evidence whitepaper explains how unresolved records stay visible for investigation.
Frameworks
Map VeriProof records to your controls
The compliance hub shows which VeriProof records support each framework requirement. Your assessor still decides whether a control is met. Healthcare teams can start with HIPAA controls and BAA terms.
Security vulnerability disclosure
Use the security contact form to ask for a private reporting channel. Leave exploit details, credentials, and customer data out of that first message; we reply within one business day.
Trust and compliance questions
Start with the list above. Public items are linked there. For the data processing agreement, questionnaire answers, or source access, use the diligence form and tell us your deadline.
Each environment uses one of them, chosen when it's created. Azure SQL Database Ledger is the default: it keeps each record's fingerprint in Azure and checks it against separately protected database digests. Your auditor gets read-only verification access for the review.
Choose Solana instead when reviewers need a public proof. Only fingerprints go to the public network, never decision content, personal data, or protected health information.
In the managed service, staff administration uses separate role-based controls, and staff actions are logged. Access is limited to what your agreement permits.
A Private Enterprise installation will belong to your organization, and VeriProof will have no access to it, standing or temporary. For support, your team sends a support bundle, runs the checks we ask for, or shares a screen. You choose every file that leaves your subscription.
In the managed service, in Azure in the United States (Central US). Proofs sit in Azure SQL Database Ledger unless you choose Solana, which receives fingerprints only.
Private Enterprise will keep the platform, your records, and its ledger in your own subscription. See where your records live.
Affected sessions go through retry and reconciliation. Records that still lack a proof stay available for investigation and authorized recovery. The tamper-evidence whitepaper covers the design.
Healthcare customers can request BAA terms for review. Scope and required configuration are confirmed during contracting. The HIPAA page summarizes the technical controls.
Before access ends, download evidence packs for the records you need to keep. Each pack carries a signed file inventory and its proof records, so it stays checkable after you leave. How verification works.
We then close the account through a staff-run offboarding. We suspend access, deliver any export your agreement calls for, purge each application, and revoke keys and integrations. You get written confirmation once every data store has been checked.
Your agreement sets the deletion date and when backups expire. Records under an active legal hold stay until the hold is released. Solana commitments remain on the public network. Your agreement also names any integrity records we keep after deletion.