Trust centre
Hosting, controls, documents and sub-processors, each with the date it was checked or stated. Nothing here is shown without one.
Last checked 09.11.2026 18:00
Overview
Veritome is built and operated by Relay Labs Ltd in Dublin, Ireland. The application, its database and its object storage run in Hetzner data centres in Germany, and the assistant runs on Mistral models hosted in Paris, so customer data stays inside the EU. This page shows what we monitor automatically, what the founder has attested with a date, and what we have committed to but not yet done.
Veritome does not provide a high-risk AI system. Aria, the assistant inside the product, is built on a general-purpose model and is subject to the Article 50 transparency duties, which the AI transparency page meets; everything Aria proposes is approved by a person before it takes effect.
as of 24.10.2026 · Stated by FounderRelay Labs Ltd is the controller for account and billing data and the processor for customer content, under the Data Processing Agreement published at /dpa. All processing is in the EU/EEA; the one US sub-processor, Stripe, operates under standard contractual clauses. The Data Protection Commission is our supervisory authority.
as of 24.10.2026 · Stated by FounderVeritome has no SOC 2 report and has not engaged an auditor. We will state a date here when one is engaged. Neccessary controls and requirements are being completed internally using our own platform while testing this additional framework to be added for all users in 2027.
as of 24.10.2026 · Stated by Founder- Application hosting
- Hetzner (Nuremberg, Germany)EU
- Database
- Hetzner (Nuremberg, Germany)EU
- File storage
- Hetzner Object Storage (Falkenstein, Germany)EU
- AI processing
- Mistral AI (Paris, France)EU
- Rate-limit store
- Upstash Redis (AWS eu-central-1, Frankfurt)EU
- Error monitoring
- Sentry EU region (Germany)EU
- Product analytics
- PostHog EU Cloud (Frankfurt)EU
- Transactional email
- Plunk on Hetzner (Germany, EU)EU
- Payment processing
- Stripe (Dublin, Ireland · PCI DSS L1)SCCs
- Sign-in & analytics
- Google (Ireland · USA)SCCs
- Sign-in (Entra ID)
- Microsoft (Ireland · USA)SCCs
- Evidence connector
- GitHub (USA) — opt-inSCCs
- Evidence connector
- Atlassian Jira (USA) — opt-inSCCs
Controls
Resources
- Privacy policyPurposes, lawful bases, retention and your rights
- Data processing agreementArticle 28 terms and the sub-processor list
- Sub-processorsEvery third party that touches your data
- Terms of serviceSubscription terms and liability
- Acceptable usePermitted use of the toolkit
- SBOMComponent and licence summary; full SBOM on request
Sub-processors
11 providers; 6 process data in the EU and 5 outside it under standard contractual clauses.
FAQ
Where is customer data hosted?
The application and its database run on Hetzner in Nuremberg and object storage on Hetzner in Falkenstein, both in Germany. AI requests are processed by Mistral in Paris. The sub-processor register names every provider, where it processes data and the transfer basis for anything outside the EEA.
See: Sub-processors
Is data encrypted?
In transit, every connection uses TLS, and HSTS tells browsers to use nothing else; both are measured by the collector and shown under Controls with the time of the last check. Second-factor secrets and identity-provider credentials are encrypted with AES-256-GCM before they are stored.
See: TLS certificate
How is the database backed up?
The database is backed up on a schedule to a storage location separate from the server. The Controls section shows when this was last attested and when a restore was last drilled.
See: Off-box backups
Updates
No entry published yet. Each control attested, document published or re-issued, sub-processor change and incident is recorded here when it happens.
Ask
The security report is sent under NDA to a work address. Security questionnaires and DPA questions go to security@veritome.eu.