Vera AI · Security

Security review package

Request documents under NDA Email this package to your security team → Download as one PDF

Everything your security team needs, one link. For the reviewer, not the buyer: every document below is public with no account, every claim is live today, and the gaps are listed as plainly as the controls. Forward this URL and the review starts without a meeting.

START HERE · THE READING ORDER

Eight steps, roughly ninety minutes.

01The security overview: the data promise, the enforced numbers, and the claim ladder including what is not built.15 min

02The security team FAQ: 63 questions across eleven sections, written for reviewers; most questionnaire lines map one to one.30 min

03The data processing addendum: clause by clause with the annexes, public, no NDA needed to read it.10 min

04The subprocessor list: who runs what, the data each provider receives, and where.5 min

05The Master Subscription Agreement and the terms: the MSA, the SLA, the acceptable use policy and the order form as PDFs, with the terms of service.15 min

06The trust center: certifications held, framework status, the resilience and validation evidence table, and the NDA document room with the policy set and the pre-completed questionnaire.10 min

07The responsible disclosure policy: and the security.txt it stands behind.5 min

08The security and data review guide: the whole set above as one PDF, for the reviewer who wants a file.PDF

The package, piece by piece.

Security overview

The architecture stated as evidence: 270+ tables under row-level security with 39 isolation suites in CI, 60 second signed downloads, the AI data flow, the 72 hour incident commitment, and a claim ladder with an explicit Not yet column. Check the ladder first; it tells you whether to believe the rest.

vendorbenchmark.com/security →

Security team FAQ, 63 questions

Tenant isolation mechanics, identity, data lifecycle, the AI data flow, benchmark anonymity, audit and incident response, subprocessors, compliance, and an honest section on what we do not have yet. Check the answers against your questionnaire; most map one to one.

vendorbenchmark.com/security-faq →

DPA, subprocessors, terms

All public. Check the subprocessor list against the AI data-flow claims (each AI provider is named with the feature that calls it and the data it receives) and the DPA's deletion commitments against the deletion certificate feature.

/dpa · /subprocessors · /terms

Trust center: status and evidence

Framework status stated honestly (SOC 2 Type I targeted Q4 2026, report under NDA when issued) plus the resilience table: backups, restore tests, and penetration testing, each with a date or an honest not yet.

vendorbenchmark.com/trust-center →

NDA document room

The policy set and a pre-completed security questionnaire, delivered through scoped, expiring, revocable links behind a click-through NDA. Every open is written to an audit log.

Request access →

In-product verification

With a login: the Security Center (your org's MFA coverage, audit export, SIEM webhook), the audit trail itself, and the deletion certificates under Settings. These are the controls you verify rather than trust.

Security Center (login) →

VERIFY, DON’T TRUST

Three things your team can prove alone, in a trial tenant.

1. Run the isolation test

Create two organizations, upload a document to one, and confirm the other’s session cannot read it. The denial comes from the database’s row-level security, not an application error page.

2. Watch your own audit stream

Subscribe an audit webhook and signed, cursor-tracked batches of your org’s events arrive within 15 minutes. Compare them against what your team actually did, down to the AI runs.

3. Test deletion end to end

Delete a contract, confirm rows and files are gone, then download the timestamped deletion certificate the deletion wrote. Deletion is a data path, not a support ticket.

THE HONEST GAPS

What we do not have yet, so you can believe what we do.

• EU data residency: not built, all data is hosted in the US today • SOC 2: Type I targeted Q4 2026; controls implemented and mapped to evidence today • ISO 27001: not started, SOC 2 comes first • Customer-managed keys (BYOK): not built • Passkeys / WebAuthn: not built, TOTP is the second factor today

The full, dated version lives on the security page’s claim ladder and moves left only when the code or the evidence exists.

OUR SIDE OF THE REVIEW

We will complete your questionnaire, walk the architecture, and show the cross-tenant read failing live.

Security at VendorBenchmark is owned by Fredrik Filipsson, founder. Vulnerability reports are acknowledged within 3 business days with safe harbor for good-faith research, and if an incident ever affects your data you hear it from us within 72 hours of confirmation, followed by a written post-mortem. We sign your NDA or bring ours.

Set up the review →