Vera AI · Security

Trust center

Request documents under NDA Security review package Download the review guide (PDF)

Where we stand, stated as evidence. Framework status, the controls behind it, the claim ladder including what is not built, the resilience record with dates, every public document, and the NDA document room for the rest. A framework is only ever claimed with the evidence to show for it.

THE SECURITY REVIEW Security overview Security and data FAQ Data processing addendum Subprocessors Trust center Responsible disclosure Security review package Security and data review guide (PDF)

270+

customer tables covered by Postgres row-level security

automated cross-tenant isolation suites run in CI on every change

60 s

signed download URL lifetime, minted per request, never pre-signed into a page

200 MB

upload cap, with the file's actual byte signature checked, not its extension

12+

character password minimum, screened against known breach corpora before acceptance

1 year

maximum age of API keys and SCIM tokens, stored as SHA-256 hashes

15 min

audit event batches streamed to your SIEM, signed and cursor-tracked

72 h

to hear from us directly once an incident affecting your data is confirmed

CERTIFICATIONS

What certifications we hold, stated plainly.

The question every IT security review asks first, answered without a borrowed badge: none issued to Vendor Benchmark yet, SOC 2 underway, the infrastructure providers audited, and an independent penetration test complete.

CERTIFICATION OR ATTESTATION	STATUS	DETAIL
Certifications held by Vendor Benchmark	None issued yet	We do not borrow a badge: no certification is claimed until a report exists.
SOC 2	Type I targeted Q4 2026	Controls implemented and mapped to evidence; Type II after the observation window; report in the NDA document room when issued.
Infrastructure providers	SOC 2 Type II audited	Supabase (database and storage) and Vercel (hosting); their reports are available from them.
Independent validation	Penetration test completed	First third-party test complete, annual cadence; the executive summary is in the NDA document room.
ISO 27001	Not started	Sequenced after SOC 2.

01 · FRAMEWORK STATUS

The frameworks you will ask about.

SOC 2 is an attestation issued by a licensed CPA firm after an audit, not a self-declared status. GDPR and CCPA have no government certification. We describe a framework as satisfied only when we can show you the evidence.

SOC 2 Type II

Security, Availability and Confidentiality criteria

In progress

The technical controls an auditor tests are already implemented. We are formalizing the policy set and evidence collection ahead of the observation window. We will not describe the platform as SOC 2 attested until a report exists, which we will share under NDA.

GDPR

For customers with EU and EEA data subjects

In progress

A data processing addendum is available, subprocessors are published, and customer-initiated deletion removes both rows and files. Records of processing and the data subject request workflow are being finalized with counsel before we describe the platform as GDPR compliant.

CCPA / CPRA

For California consumers and business contacts

In progress

Our privacy notice sets out the categories collected, purposes and consumer rights. We do not sell personal information. The rights intake and service-provider terms are being confirmed with counsel before we describe the platform as CCPA compliant.

ISO 27001

Information security management

Planned

Not started. SOC 2 comes first; ISO 27001 is sequenced behind it.

02 · CONTROLS

The controls behind the status.

These are the technical controls a SOC 2 auditor tests. Most are the foundation the platform was built on, so the gap to attestation is evidence and policy, not new engineering.

In place

Database-level tenant isolation

Postgres row-level security enforces the organization boundary on every query. Buggy application code cannot cross a tenant.

In place

TOTP multi-factor, enforced for admins

Platform administrators step up to AAL2. MFA is available to every customer organization and enforceable org-wide.

In place

Encryption in transit and at rest

TLS everywhere, database and storage encrypted at rest, secrets in server-side environment variables only.

In place

Full audit logging

Every view, download, create, update and delete of contract data is recorded with actor, action, entity, organization, IP and user agent.

In place

Signed, short-lived downloads

Files are served only through signed URLs that expire in roughly 60 seconds. There is no public link to any customer file.

In place

Deletion removes rows and files

Customers delete their own contracts, and deletion clears both the database rows and the stored objects, with a certificate.

In place

Upload validation and signature checks

Uploads are type-restricted, size-capped and checked against the file's actual byte signature, not just its extension.

In place

Independent penetration test

The first third-party penetration test is complete, and the cadence from here is annual. The executive summary is in the NDA document room.

03 · THE CLAIM LADDER

Implemented, in progress, and not yet.

Items move left only when the code or the evidence exists. The third column is there so you can believe the first.

Implemented18

In the code, verifiable in your own tenant.

Database-enforced tenant isolation

Since day one, tested in CI on every change

TOTP MFA, step-up, org-wide enforcement

Mandatory for our own staff

Enforced SSO and SCIM 2.0

Require SSO refuses password sign-in

Session list, revoke, sign out everywhere

With new-device email alerts

12+ character passwords, breach-screened

Privacy-preserving check before acceptance

API key and SCIM token expiry

One year maximum, hashed at rest

SIEM audit streaming and CSV export

Signed 15-minute batches

Deletion that sweeps rows and files

Organization deletion clears every bucket

security.txt and disclosure policy

With a 3-business-day acknowledgment

DPA, subprocessor list and terms

Public, no NDA needed to read them

AI runs in your audit trail

Every AI run lands in your audit log with actor, feature and model

Privileged data paths under review ratchet

A new code path that bypasses row-level security fails CI until reviewed

Break-glass sign-ins are audit-visible

An owner using the SSO bypass writes an audit event

Per-org IP allowlist and session policy

Owner-set CIDR allowlist, maximum session age and idle timeout

Deletion certificates

Every contract, retention and organization deletion writes a timestamped certificate

Anthropic zero-retention addendum

Signed; API data was already excluded from model training

Third-party penetration test

First test completed, annual cadence

Backup restore test

First restore from backup completed, quarterly from here

In progress3

Underway now, status stated plainly.

SOC 2

Type I targeted Q4 2026, Type II after the observation window; report under NDA when issued

GDPR program

DPA, subprocessors and deletion live; records of processing being finalized with counsel

CCPA / CPRA

Privacy notice live; no sale of personal data

Not yet5

We list what we have not built so you can believe the first column.

ISO 27001

Not started; SOC 2 comes first

Customer-managed keys (BYOK)

Not built

EU data residency

Not built; all data is hosted in the US today

Passkeys / WebAuthn

Not built; TOTP is the second factor today

Self-serve SAML onboarding

SSO works per organization today; fully self-serve identity provider setup is not built

04 · RESILIENCE AND INDEPENDENT VALIDATION

Evidence, with dates, or an honest not yet.

A backup without a tested restore is a hope, and a security page without third-party validation is a promise. This table is where the evidence lands as each program runs.

PROGRAM	STATUS	DETAIL
Backups	Enabled, provider-managed, plus an independent duplicate	Continuous backups with daily snapshots on Supabase (SOC 2 Type II audited), and a second, independent backup copy running alongside them. A backup is a hope until a restore proves it, which is what the restore test below is for.
Backup restore test	First test completed	Quarterly program. The first restore from backup has been completed; each run is recorded here.
Recovery objectives	In place: RPO under 24 hours, RTO under 24 hours	In place and exercised by the restore test above; each quarterly run is recorded here with the measured result.
Third-party penetration test	First test completed	Annual cadence. The executive summary is available in the NDA document room; every access is logged.
SOC 2	Type I targeted Q4 2026	Controls implemented and mapped to evidence today; Type II follows after the observation window. The report lands in the NDA document room when the auditor issues it.

Last updated July 2026. This table only ever states what has happened; targets are labeled as targets.

05 · DOCUMENTS

Everything public, in reading order.

Every document below is public with no account. For the whole set in one forwardable link, send the security review package; for one file, the security and data review guide carries all of it as a PDF.

Security overview →

The architecture, the enforced numbers, the AI data flow and the claim ladder, including what is not built.

Security and data FAQ →

63 questions across 11 sections, written for the reviewer working through a questionnaire.

Data processing addendum →

Roles, data categories, security measures, retention, subprocessing and the signed addendum.

Subprocessors →

Every third party that touches the service, what it does, the data it handles and where.

The terms of service, public.

Master Subscription Agreement and the other agreements →

The MSA, the SLA, the acceptable use policy, the mutual NDA and the order form, each as a PDF.

Responsible disclosure →

How to report a vulnerability, with safe harbor for good-faith research.

06 · AGREEMENTS

The Master Subscription Agreement and the paper around it.

Every agreement is public as a PDF on the agreements page, so legal can read the terms before anyone signs. The executed copies come from your account team.

Master Subscription Agreement PDF

The commercial terms every subscription sits under: license, fees, confidentiality, warranties, liability, term and termination.

Data processing addendum PDF

The processor terms, with the annexes and the standard contractual clauses where a transfer requires them.

Service level agreement PDF

Availability, support response and service credits.

Acceptable use policy PDF

What the service may and may not be used for.

Mutual NDA PDF

For the security review itself; we sign yours or bring ours.

Order form PDF

The template an order is written on.

THE NDA DOCUMENT ROOM

Request the documents under NDA.

We review each request and email a secure, NDA-gated link to a document room. The room expires, can be revoked, and logs every open. No account is needed.

INSIDE THE ROOM

The pre-completed security questionnaire
The penetration test executive summary
The policy set
The SOC 2 report when the auditor issues it

HOW THE LINK WORKS

Scoped, time-limited link, no account required
Click-through NDA captured before anything opens, or we sign yours (our mutual NDA)
Short-lived signed downloads, every access audit logged

OUR SIDE OF THE REVIEW

We will complete your questionnaire, walk the architecture, and show the cross-tenant read failing live.

Security at Vendor Benchmark is owned by Fredrik Filipsson, founder. Vulnerability reports are acknowledged within 3 business days with safe harbor for good-faith research, and if an incident ever affects your data you hear it from us within 72 hours of confirmation, followed by a written post-mortem. We sign your NDA or bring ours.

Set up the review →