FAQ

The application and its database run on Hetzner in Nuremberg and object storage on Hetzner in Falkenstein, both in Germany. AI requests are processed by Mistral in Paris. The sub-processor register names every provider, where it processes data and the transfer basis for anything outside the EEA.

See: Sub-processors

In transit, every connection uses TLS, and HSTS tells browsers to use nothing else; both are measured by the collector and shown under Controls with the time of the last check. Second-factor secrets and identity-provider credentials are encrypted with AES-256-GCM before they are stored.

See: TLS certificate

The database is backed up on a schedule to a storage location separate from the server. The Controls section shows when this was last attested and when a restore was last drilled.

See: Off-box backups

Aria, the assistant inside the product, runs on Mistral models hosted in Paris. Customer content is not used to train models, and the provider is bound to that by contract. The AI transparency page describes what Aria reads, what it may propose and what a person must approve.

See: AI transparency

Without undue delay and within 72 hours of Veritome becoming aware of a personal-data breach, as set out in section 8 of the data processing agreement, with the nature of the breach, the likely consequences and the measures taken.

See: Data processing agreement

At the end of the agreement, customer data is deleted or returned, at the customer's choice, within 30 days, unless EU or Member State law requires retention. A certificate of destruction is available on request. Section 9 of the data processing agreement sets this out.

See: Data processing agreement

Every account enrols a second factor from its second sign-in. Access inside a workspace is granted per role and per organisation, and the permission is checked on every write. Organisations on the Enterprise plan can require sign-in through their own identity provider.

See: Two-factor authentication

Only the providers in the sub-processor register, each listed with its purpose, the data it receives, its location and the agreement it operates under. A change to the register is published before it takes effect.

See: Sub-processors

Write to security@veritome.eu. The vulnerability disclosure page describes what to include, what to expect in reply and the safe-harbour terms for research done in good faith.

See: Vulnerability disclosure

The component and licence summary is public; the full SBOM is available on request from the same page.

See: SBOM