How Verity protects your deal documents
Verity's whole job is telling you what a deal's documents support, what they merely claim, and what's missing. It would be strange to describe our own security any other way. So this page uses the same three buckets. Everything under Supported you can check yourself or trace to a named third party. Everything under Claimed is true but rests on our word. Everything under Not yet is exactly that.
Supported — verifiable right now
Your documents live in private storage, isolated per workspace.
Every table in Verity's database enforces row-level security, and every document sits in a private storage bucket. A file is readable only by members of the workspace that owns the deal it belongs to. This isolation is enforced by the database itself, not by application code that could forget to check. When you open a file, Verity issues a signed link that expires in 60 seconds.
Nobody outside your workspace can reach a document except through two doors you open on purpose.
- Seller upload links. When you ask a seller for documents, they get a private link that lets them send files without creating an account. The link's secret is stored only as a one-way hash (the database never holds the secret itself), it expires on the schedule you choose (7, 14, or 30 days — the ceiling is enforced server-side), and you can revoke it at any time. Every attempt through a link is rate-limited and logged.
- Shared deal briefs. When you share a brief, the reader gets a link with an unguessable token (122 bits of randomness). Briefs contain only the analysis you chose to share — no workspace identifiers, no email addresses, no account details — and you can revoke a link at any time.
Uploaded files are checked by their actual contents, not their filename.
Whether a file arrives from you or from a seller, Verity inspects its bytes before any analysis runs. A file named .pdf that isn't a PDF is rejected, never analyzed, and never counts against anything. Seller uploads are additionally quarantined until you review and accept them — nothing a seller sends is analyzed automatically.
The app sends your browser the protections a careful security reviewer looks for.
Strict transport security (HTTPS enforced for a year, subdomains included), MIME-sniffing protection, frame-embedding denied, a strict referrer policy, and a permissions policy that disables camera, microphone, and location. A Content Security Policy is enforced: browsers block any script that is not ours or on a short allow-list, and violations are still reported to us.
Check it yourself: run app.verityintelligence.co through securityheaders.com, SSL Labs, or Mozilla Observatory.
Optional two-factor authentication.
Any user can add an authenticator-app code (TOTP) to their sign-in from Settings → Security & Access Control. When it's on, the app requires the code before anything else loads. It is optional and never forced.
Card data never touches Verity.
Payments run through Stripe, which is certified PCI DSS Level 1. Verity stores no card numbers.
What we run on, stated as inheritance.
Verity runs on Supabase (database, storage, authentication), Cloudflare (application hosting, TLS, DDoS protection), and Stripe (payments). Supabase holds SOC 2 Type II and ISO 27001; data is encrypted at rest (AES-256) and in transit (TLS). These are their certifications for their infrastructure. Per Supabase's own shared-responsibility model, they do not transfer to Verity as a company — see Not yet below for where Verity itself stands.
Claimed — true, on our word
We store as little about you as we can.
IP addresses on upload attempts are stored only as keyed hashes, never raw. Share-link tokens never appear in our logs or error reports; internal reporting redacts them before anything is written.
Every anonymous entry point fails closed.
If a seller link is malformed, expired, revoked, or over its limits, the response says so and nothing else — a wrong link is indistinguishable from a nonexistent one. Rate limits tighten when they're tripped rather than reset.
Access to the platform's own controls is narrow.
Server-side functions that mutate or read across workspaces are callable only by Verity's backend, not from the browser. Exactly one function is reachable anonymously — the one that serves our published legal documents — and it is read-only.
We review our own security posture on a written record.
Each finding from our internal audits is logged with a severity, a decision (fixed, accepted with a stated reason, or deferred with a trigger), and the evidence. We would rather tell you what we chose not to do and why than imply a gap doesn't exist.
Your documents are processed by an AI provider to produce the analysis.
Document contents are sent to Anthropic's API to generate Verity's extraction and analysis. Under Anthropic's Commercial Terms, content sent through the API is not used to train Anthropic's models by default; Anthropic's standard API data-retention policy applies. (Anthropic's data-use policy · Commercial Terms)
Not yet — honestly
No third-party attestation of Verity itself.
Verity has not completed a SOC 2 audit and does not claim SOC 2 compliance. We display no badge because we have no report. When a prospective customer's review requires one, that is the trigger for the formal program, and we will say so here the day it changes.
No malware scanning of uploads.
Files are validated by type, not scanned for malware. A well-formed malicious PDF would pass our checks and be caught, if at all, by your own device's protections when you open it. This is typical at our stage; we will revisit it as usage grows.
Sessions don't expire on a timer.
We chose not to force periodic re-login for people working a deal late at night. Compensating controls are on: a stolen session cannot change your password without knowing the current one, and compromised refresh tokens are revoked automatically.
Report a security issue
If you find something, we want to hear about it before anyone else does. Write to security@verityintelligence.co. We reply to every report and credit responsible disclosure if you'd like us to.
Last reviewed: September 2, 2026. This page describes the live system as of that date and is updated when the system changes.