Security at Veritas
You're trusting us with the most sensitive data your business holds.
Here is how we earn it. In detail, in plain language, and verifiable where it matters. Veritas holds the research, documents, and workspace data of professionals across Europe. The same standard of care your clients expect of you, we apply to ours.
Reach the team directly at [email protected].
GDPR compliant
EU controller with full data subject rights. Standard contractual clauses where they apply, no transfers outside the EEA by default.
EU data residency
All customer data is stored and processed in the European Union, across providers whose data centres carry ISO 27001 certification.
No AI model training
Your documents, searches, and workspace activity are never used to train or improve foundation models.
How we think about security
Four ideas that shape every decision
We don't have every certification yet, and we say so plainly. What follows is the work we do today, expressed as the principles that produced it.
Defense in depth
Multiple independent layers across encryption, identity, network, and application. No single failure exposes data, and no single component is treated as trusted.
Least privilege
Internally, every employee. In the product, every user. In our AI agent, every action. Each is granted the minimum access required for its purpose, and no more.
Transparency
We publish our subprocessors, our practices, our status, and our incident history. You can verify what we say, not only trust it.
Customer agency
You can see who has access, what they did, export your data, and delete it. Your security posture is yours to own, and we give you the tools to own it.
Architecture
Defense in depth, from disk to delivery
The controls below span encryption, network, isolation, and application layers. Each is implemented today. Ask us about any of them in detail.
Encryption & key management
- AES-256 at rest
- All stored data encrypted with AES-256. Keys managed by a cloud KMS, with HSM-backed protection for critical key material.
- TLS 1.3 in transit
- External traffic over TLS 1.3 with modern cipher suites. Mutual TLS between internal services.
- Key separation & rotation
- Encryption keys logically separated from customer data. Rotated annually, with envelope encryption for sensitive fields.
Network & isolation
- Strict tenant isolation
- Each team is isolated at the application and database layer. Cross-tenant access is impossible by design.
- EU multi-cloud
- Hosted on multiple cloud providers across EU regions. Their data centres carry ISO 27001 and ISO 27017/18 certifications.
- Private network
- Private VPCs, segmented subnets, no public database endpoints. Edge WAF and DDoS protection at the network edge.
- Production isolation
- Production data is never present in staging or test. Pre-production environments use synthetic or anonymised fixtures.
Application defences
- Secure SDLC
- Mandatory peer review, static analysis, dependency scanning, and threat modelling for new surface area.
- OWASP-aligned
- Top 10 controls baked into development standards. OWASP LLM Top 10 applied to every AI feature.
- Continuous scanning
- Severity-based remediation SLAs. Critical issues addressed within 7 days, high within 30 days.
- Annual penetration tests
- Third-party authenticated and unauthenticated tests at least annually. Executive summary available under NDA.
- Web Application Firewall
- Edge WAF blocks common attacks including injection, cross-site scripting, and automated abuse.
- Responsible disclosure
- Coordinated disclosure policy and security.txt published. Report a vulnerability to [email protected].
What you control
The toolkit you own
Security in Veritas is a partnership. You decide who sees what, observe what they do, and step in when something looks off. The capabilities below are available to your admins from day one.
- Passwordless sign-in.
- Sign in with a one-tap magic link instead of a password. The ceremony flows cleanly through identity, method and credential.
- Passkeys and strong MFA.
- Passkeys (WebAuthn/FIDO2), TOTP authenticator apps and one-time recovery codes. Available for every user and enforceable organisation-wide.
- A personal Security Center.
- Each user manages their passkeys, password, TOTP, recovery codes and API keys from one consolidated page.
- Single sign-on (SAML 2.0).
- On Enterprise. Connects to Okta, Microsoft Entra ID, Google Workspace, and others through your existing identity provider.
- Role-based access control.
- Granular permissions per module and per action. Permission changes are recorded and reviewable by your admins.
- Customer-visible audit logs.
- Every privileged action visible to your admins with who, what, when, and from where. Exportable to your SIEM or as a file.
- Session controls.
- Idle timeout, per-device session revocation, and sign-out-of-all-devices in one click.
- Modern password policy.
- NIST SP 800-63B aligned. Length over complexity, no forced rotation, checks against breached-password lists.
- IP allowlisting.
- Enterprise tier. Restrict access to specific IP ranges or corporate networks.
Workspace access
Acme Holdings Ltd, 24 members
- MPOwner
Maria Papadopoulou
- JKResearcher
James Kuriakou
- ACEditor
Anna Constantinou
- TLReviewer
Theodoros Leventis
Just-in-time access request
Reviewed and bounded in time
Reason
Customer ticket #4823. Investigating a document that fails to index.
What we control internally
No standing access. Every action accounted for.
Our engineers do not have always-on access to customer data. When access is required, it is requested, approved, time-bound, and logged. The discipline below is what stops insider risk from being theoretical.
- Just-in-time production access.
- Employee access is granted by need, approved by a second engineer, time-bound, and fully logged. No standing access to customer data.
- Phishing-resistant employee MFA.
- FIDO2 security keys for every engineer and operator with production access. No SMS, no recovery codes, no shared secrets.
- Background checks.
- Pre-employment screening for all staff who could come into contact with customer data.
- Centrally managed devices.
- Company laptops enrolled in MDM, full-disk encryption enforced, endpoint detection and response running on every machine.
- Zero Trust network.
- Every access request is authenticated and authorised regardless of network origin. No trusted internal network, no VPN bypass.
- Joiner, mover, leaver discipline.
- Identity and access provisioned and deprovisioned through central identity. Access revoked the day someone leaves.
Detect and respond
When something goes wrong, you hear about it
The fastest way to lose trust is to leave customers in the dark. Our detection and response practice exists to catch problems early, contain them quickly, and tell you within hours, not days.
- Centralised logging.
- Application and infrastructure logs aggregated and correlated with behavioural events.
- Continuous monitoring.
- Authentication, access, and infrastructure-level signals monitored continuously, with an on-call rotation for security alerts.
- Intrusion detection and prevention.
- IDS and IPS at the network layer to detect and block unauthorised access attempts in real time.
- Tested incident response playbooks.
- Documented playbooks rehearsed at least annually. Named incident commanders for each severity level.
- 48-hour breach notification SLA.
- GDPR requires 72 hours to authorities. We commit to notifying affected customers within 48 hours of a confirmed breach.
- Public status page.
- Live availability and incident history. Subscribe to be notified of incidents the moment they are declared.
Incident response timeline
From signal to customer notification
Signal detected
T+0
Anomalous authentication pattern flagged by continuous monitoring.
Triage and contain
T+15m
On-call engineer paged. Containment actions executed under runbook.
Investigation
T+2h
Scope determined. Affected tenants and data classes identified.
Customer notification
T+48h
Affected customers contacted with scope, impact, and next steps.
48-hour notification commitment
GDPR allows 72 hours to authorities. We commit to 48 hours to you.
Sovoc AI action log
All agent activity, attributable to a user
Drafted a research summary
Initiated by [email protected], awaiting approval
14:02
Compared 17 source documents
Competition law workspace, updated March 15
13:58
Suggested a related authority
Linked to three passages in the current brief
13:51
Awaiting approval
Publish research brief to the team library
13:44
Sovoc AI security
Autonomous in capability, accountable by design
Sovoc AI is the agent that operates inside Veritas. It is more capable than any human user, so the constraints we place on it are stricter.
- Bounded by your permissions.
- Sovoc AI acts within the same role-based envelope as the requesting user. It cannot escalate privileges or access data the user could not already see.
- Your data is never used to train models.
- Customer data is not used to train, fine-tune, or improve any foundation model. First- and third-party model providers operate under zero-retention enterprise terms.
- Grounded in primary sources.
- Every answer is drawn from and cited to real documents in the library. Sovoc AI surfaces the authority, does not invent it, and tells you plainly when the sources do not settle a question.
- Full action audit trail.
- Every Sovoc AI action is logged with the originating user, the prompt, the model version, the tools called, and the outcome, visible to your admins.
- Prompt injection defences.
- Inputs are sandboxed, tool calls are scoped to the user's privileges, and outputs pass through guardrails before any privileged action executes.
- AI subprocessors disclosed.
- We use OpenAI and Anthropic under enterprise contracts, listed publicly on our subprocessor page alongside their roles and jurisdictions.
Privacy & data handling
Your data is yours, and we make that obvious
EU-only residency, a published subprocessor list, plain-language descriptions of what we collect and why. The mechanics of GDPR, made operational and self-service wherever they can be.
- EU-only by default.
- All customer data is stored and processed within the European Union. SCCs are in place for any out-of-EEA transfer, which is not our default.
- Subprocessor transparency.
- A public, versioned list of every third party with potential access to customer data, with their purpose and jurisdiction.
- 30-day retention after termination.
- Customer data is deleted within 30 days of contract end unless legal retention obligations require otherwise.
- Customer-initiated export and deletion.
- Your admins can export your data at any time and delete it under GDPR Article 17 right to erasure.
- Named privacy contact.
- Reach our privacy team at [email protected] for SARs, complaints, DPA requests, or questions about lawful basis.
Your data, your control
Self-service rights, available to every admin
Export your data
DOCX, PDF, JSON, and source archives
Delete on request
GDPR Article 17, in-app and on contract end
Subject access requests
Standard SAR workflow, 30-day response
EU residency by default
No transfers outside the EEA unless authorised
Subprocessor transparency
Versioned public list with change notifications
Resilience & continuity
Built to keep going when it counts
A filing deadline. A client on the phone. Advice due today. When you need an answer, the platform has to be there. These are the commitments we plan against, test against, and publish.
- 48h
- Breach notification commitment
- 365 days
- Encrypted backup retention
- ≤ 1h
- Recovery point objective
- ≤ 4h
- Recovery time objective
Backups are encrypted and geographically distributed. Disaster recovery is tested annually with documented results. Business continuity policy reviewed annually.
Sensitive surfaces
Where the data is most sensitive
What you research, and the documents you bring to it, reveal a great deal about your clients and your work. Each of these surfaces gets its own treatment, called out here so you know exactly how the most sensitive flows are handled.
Your research
Your questions and searches reveal what you are working on. They are encrypted, never sold, and never used to train third-party models.
Your documents
Anything you upload is processed in our own infrastructure and held to the same standard as our core libraries, isolated to your account.
Identity & access
Credentials, passkeys, and sessions sit in the strictest data class, with tighter access controls and field-level protections where they apply.
AI processing
Question-answering runs under our own controls. Your queries and content are never sent to train a third-party model without your consent.
People, ethics, and conduct
Security depends on the people who build it
The behaviours and policies we hold ourselves to, alongside the controls applied to the people behind the platform.
People security
- Background checks
- Pre-employment screening for staff with potential access to customer data.
- Joiner, mover, leaver
- Identity and access provisioned and deprovisioned through central identity. Access revoked the day someone leaves.
- Acceptable Use Policy
- All employees and contractors acknowledge our internal AUP on joining.
- Confidentiality
- Every staff member and contractor operates under written confidentiality obligations.
- Annual security training
- Security awareness training for all staff, secure-coding training for engineers, and phishing simulations.
- Third-party risk management
- Vendor due diligence before onboarding, with ongoing review of suppliers with access to customer data.
Ethics & conduct
- Code of Ethics
- Public code applicable to all employees and contractors, governing day-to-day decisions.
- Anti-bribery & corruption
- Formal policy and annual training. Zero tolerance for facilitation payments or kickbacks.
- Anti-modern-slavery
- Statement aligned with the UK Modern Slavery Act and equivalent EU instruments.
- Fair labour
- Public statement of fair-labour practices across all employment and contractor relationships.
- Whistleblowing programme
- Confidential reporting channel with a formal non-retaliation policy.
- Supplier Code of Conduct
- The behaviours we require of every supplier, applied during onboarding and reviewed annually.
Trust artifacts
What to take to your procurement team
The documents and assessments you can request from us. Some are public. Others are available on request, or under NDA.
- Public
Privacy Policy
How we collect, use, and process personal information. Linked from every page footer.
- Public
Service Level Agreement
Availability commitments, support response times, and credits for missed targets.
- Public
security.txt
Coordinated disclosure contact published at /.well-known/security.txt per RFC 9116.
- On request
Data Processing Addendum
Standard DPA template aligned with GDPR. Signed by us on request.
- On request
Security overview one-pager
Plain-language summary of our practices, suitable for sharing with stakeholders.
- On request
Vendor questionnaires
We respond to CAIQ Lite, SIG Lite, and VSA-Q. Custom questionnaires considered on request.
- Under NDA
Subprocessor list
Every third party with potential access to customer data, versioned with change notifications.
- Under NDA
Architecture and data-flow diagrams
Sanitised technical diagrams of our platform, available to evaluators under NDA.
- Under NDA
Penetration test summary
Executive summary of our most recent third-party penetration test.
- Under NDA
PII evidence
Certificate of coverage for our professional indemnity insurance.
Need one of these? .
Frequently asked questions
The questions buyers, IT teams, and procurement raise the most. If yours is missing, send it to us and we will respond, then add it here.
- Where is my data stored?
- All customer data is stored and processed in the European Union, across providers whose data centres carry ISO 27001 and ISO 27017/18 certifications.
- Who at Veritas can access my data?
- Production access is granted by need, time-bound, and fully logged. No employee has standing access to customer data. Every privileged action by Veritas staff is recorded and reviewable.
- Is my data used to train AI models?
- No. Customer data is never used to train, fine-tune, or improve any foundation model. First- and thirty-party model providers operate under enterprise contracts with zero-retention and no-training terms.
- Why don't you have ISO 27001 or SOC 2?
- We are not yet certified. We have chosen to publish the controls themselves rather than rely on a badge while certification is in progress. We respond to vendor questionnaires (CAIQ Lite, SIG Lite, VSA-Q) and welcome detailed scrutiny of our practices.
- Can I get a copy of your penetration test report?
- We share an executive summary of our most recent third-party test under NDA. Contact our security team to start the process.
- What happens to my data if I cancel?
- Customer data is deleted within 30 days of contract termination, unless a legal retention obligation requires otherwise. You can export everything before that window closes.
- What happens if Veritas is acquired or shuts down?
- Our terms commit us to giving customers reasonable notice and a data export window in either scenario. The default is your data leaves with you in machine-readable formats.
- What is your breach notification commitment?
- We commit to notifying affected customers within 48 hours of a confirmed breach. GDPR requires 72 hours to authorities. We hold ourselves to a faster standard for the people whose data is involved.
- Do you support SSO and MFA?
- Yes. SAML 2.0 SSO on Enterprise. MFA with TOTP authenticator apps and WebAuthn or FIDO2 security keys is available for every user and can be enforced organisation-wide.
- Are you used by regulated entities?
- Yes. Veritas is used by law firms, compliance teams, policy researchers, and in-house legal teams operating under European regulation. Customer references are available under NDA.
- Is Veritas suitable for processing health data?
- No. Veritas is not designed for protected health information or other special-category health data. We ask customers not to upload medical records or similar content.
- Can external collaborators access the data they need?
- Yes. Grant workspace access by role, revoke it when the engagement ends, and review every privileged action in the audit log.
- How do you handle subject access requests?
- Send the request to [email protected]. We acknowledge within 5 business days and respond within 30 days, the GDPR statutory window.
Bring the hard questions
Our security team answers procurement questionnaires, walks evaluators through our architecture, and signs DPAs. The harder the question, the more useful the conversation.
Or write to [email protected].