What is in place today.
Every claim on this page is implemented. Certifications we do not hold are listed under roadmap.
Data in the EU
Database and files in Frankfurt, Germany. No customer data leaves the EU.
Private files
No public URLs. Downloads use 5-minute signed links and are recorded.
Tenant isolation
Row-level security enforced in the database and in every query.
Immutable audit trail
Append-only, hash-chained log with an integrity check in the product.
Accounts
Password hashing, two-factor authentication, session list, rate limits.
Transport
TLS, strict security headers, content security policy with nonces.
AI provider
Documents are sent to the model only for extraction; nothing is used for training.
Share links
Random tokens stored as hashes, with expiry and one-click revocation.
Sub-processors
| Service | Provider | Location |
|---|---|---|
| Hosting | Hostinger International Ltd. (VPS) | Frankfurt, Germany (EU) |
| Database | PostgreSQL on the same server | Frankfurt, Germany (EU) |
| File storage | Private disk on the same server | Frankfurt, Germany (EU) |
| Mail server on the same host | Frankfurt, Germany (EU) | |
| AI extraction | Anthropic API (when configured; no training on inputs) | US |
Roadmap
- ISO 27001 certification
- Independent penetration test report
- SSO (SAML / OIDC)
Security questions or reports: info@veregis.com