Trust / Privacy
A plain-language description of the information Veriom needs, where AI processing fits, how evidence is protected, and the controls teams retain.
Last updated 29 August 2026
Collect
Only authorised service data
Reason
Bounded and redacted context
Retain
Policy and purpose limited
Account, workspace, membership, integration, operational, and evidence data needed to provide Veriom. This can include repository metadata, bounded source evidence, scanner observations, architecture relationships, review artifacts, and actions approved by your team.
To authenticate users, ingest authorised evidence, produce architecture and security reviews, provide support, secure the service, measure reliability and cost, and meet legal obligations.
Customer evidence is workspace-scoped and treated as confidential service data. Access is limited by role and service purpose. Veriom does not publish customer source, findings, reports, or prompts as marketing content.
Veriom sends bounded, redacted context to provider-pinned models through LLMGateway. Requests use store false and the gateway organisation is configured for metadata-only retention. Veriom persists final structured artifacts and measured usage, not hidden reasoning or model tool transcripts.
Operational logs and optional analytics are separate. Logs use identifiers, status, latency, and failure metadata. Optional website analytics stay disabled until consent and must not contain repository source, findings, evidence, secrets, prompts, or report contents.
Retention depends on the data class, workspace policy, and service lifecycle. Workspace deletion enters an auditable workflow covering tenant data, objects, vectors, reports, and credentials. Backups and provider records may follow their documented expiry windows.
Veriom uses tenant-scoped authorization, row-level database policies, encrypted transport, bounded workers, expiring credentials, and auditable administrative actions. No system can promise zero risk, so suspected exposure should be reported immediately.
Contact hello@veriom.ai for privacy, confidentiality, access, correction, export, or deletion requests. We may need to verify identity and workspace authority before acting.
Data lifecycle in practice
Authorised repositories, ZIP uploads, scanners, and MCP clients enter through scoped contracts and archive guards.
Source snapshots and raw artifacts are envelope-encrypted with per-workspace data keys and authenticated context.
Models receive selected evidence. Gateway requests use store false; final structured artifacts and measured usage are retained.
Workspace deletion covers tenant rows, objects, vectors, reports, and credentials through an auditable lifecycle.
This public overview describes the current product approach and is not a substitute for an executed agreement or negotiated enterprise terms. Veriom does not present this page as a certification. Provider behavior is governed by the active configuration and applicable provider agreements.
