Last updated: October 6, 2026.
VeriCord stores project documents and review results for the workspaces that upload them. This page describes the safeguards we use. It is a description of the program, not a certification and not a warranty that the Services will be free of vulnerabilities. Controls below are limited to what the production Service actually does.
Security principles
- Least-privilege access and authorization by account role.
- Separation of customer workspaces and project permissions.
- Encryption of data in transit, and encryption at rest where the production providers support it.
- Logging and a path to report and investigate security issues.
- Controlled use of third-party infrastructure and model providers.
- Human oversight for engineering-facing outputs, as described in the professional judgment disclaimer.
Data flow
Customer files are uploaded to the VeriCord environment, processed to support document extraction, analysis, review, and questions you ask about a review, and made available to authorized users in the applicable workspace. Where a subprocessor is used, data is sent only as needed to provide the requested service.
Each review belongs to an account or a team workspace. Database access is enforced with row-level security so a user can read and change only the records their membership allows.
Controls in production
Encryption in transit. The Service is served over HTTPS.
Encryption at rest. Review files are stored in access-controlled object storage. Database traffic stays on the provider network. Stored data is encrypted at rest where those providers support it.
Authentication. Sign-in uses a magic link or a passkey. Keep the email account that receives sign-in links secure. Anyone with access to that inbox can request a sign-in link. Administrative access to production systems is limited to people who need it to operate the Service.
Authorization. Access is restricted to the account or workspace membership and role that the product enforces. You decide who joins a workspace.
Tenant separation. Customer workspaces are separated by row-level security so one customer cannot read another's records through the application.
Logging. Application and security-relevant activity needed to operate the Service and investigate incidents is logged. A public retention period for those logs is not stated here until it is confirmed.
Application security. Actions that change data use server-side authorization and input validation. Dependencies are reviewed as part of normal development. Errors may be reported to an error-monitoring service with enough context to diagnose a failure, without intentionally attaching document contents.
Backups, vulnerability cadence, and recovery times. Production data is protected by the hosting provider's storage and by operational backups. Specific recovery-point and recovery-time figures, and a named vulnerability-scanning cadence, are not published on this page until they are confirmed.
Model providers
To produce findings, text extracted from the drawings and specifications is sent to the model providers listed on the subprocessors page. A second provider may receive the evidence for high-value findings so it can check them without being shown the first model's conclusion. Questions you ask about a review are sent with the job context needed to answer them.
Those providers process the content to return a result. They are not given your password. Customer Content is not used to train their public models. Customer project information is not sent to public consumer AI services outside those production integrations.
Retention and deletion
Customer project data is retained while the account or workspace is active, and then as described in the privacy notice. You can ask for deletion through the contact page, subject to legal, security, backup, and contractual requirements. Backup copies may remain until they age out of the backup cycle.
Subprocessors
VeriCord uses the third parties listed on the subprocessors page for hosting, model processing, authentication, payments, monitoring, communications, and support. That list is updated before a new subprocessor starts processing Customer Content. Where a contract requires it, enterprise customers receive notice of a material change.
Your responsibilities
- Limit project access to people who are authorized to see the documents.
- Do not upload information your contract or the law prohibits you from sharing with the Service or with the model providers.
- Decide whether VeriCord is approved for the sensitivity of the data before you upload it.
- Reviewer decisions recorded in VeriCord are visible to members of that workspace.
- Report a suspected account compromise or security issue through the contact page.
Reporting a vulnerability
If you believe you have found a security weakness, contact us through the contact page. Give enough detail for us to reproduce the issue, and give us a reasonable time to investigate before any public disclosure. Do not access other customers' data, disrupt the Service, or violate privacy law while testing.
Enterprise reviews
Enterprise customers may request reasonable security documentation, questionnaires, a description of the data flow, and contractual data-protection terms. VeriCord may provide sensitive security information under confidentiality restrictions rather than on this public page.
What this page does not promise
No hosted service can guarantee that unauthorized access will never occur. See the terms of use for the warranty disclaimer that applies to the Services.