Security
Institutional-grade security for your most confidential deals
Investors, lenders and developers trust Veridue with the data behind billions of dollars of assets, and you can too.
We protect your data through controls built to ISO/IEC 27001:2022 and SOC 2 standards, continuous monitoring and independent testing, so security is never the reason a deal slows down.
SOC 2 Type II
In progress
Monitored by Vanta
GDPR
ISO/IEC 27001:2022
In progress
Built to be audited
Built to leading security standards and independently checked
Our information security management system is built to ISO/IEC 27001:2022 and the SOC 2 Trust Services Criteria, and we operate to those standards today. Certification is in progress, and certificates and reports will be available under NDA once issued. We are happy to complete your security questionnaire.
Encrypted, with clear retention and deletion
Your data is encrypted using AES-256 at rest and TLS in transit. After termination, you can export your documents, Q&A records and downloadable reports for 30 days. We delete your content at the end of that period, subject to routine encrypted backup expiry and legal retention requirements.
Role-based access, controlled and logged
Access is granted on the principle of least privilege and by role. Multi-factor authentication is required for access to production systems. Customer permissions control project and invited-party access, and administrative and support access is logged.
Monitored and independently tested
We monitor our production systems continuously and commission third-party penetration testing annually, with findings tracked through to resolution.
We never train AI on your documents
Our edge comes from our own domain models and energy ontologies, not from your files.
Your deal data is confidential and kept separate for each customer. Access is limited to authorised people and providers who need it to deliver and secure the service, and your content is never shown to other customers. We do not use your content to train or fine-tune our or third-party AI models.
You decide who sees your deal data, and how long we keep it
Kept separate for every customer, and never shared across customers
Never used to train our or third-party AI models
You decide who has access, and you control retention and deletion
See it for yourself
Our Trust Center gives your security and IT teams a live view of our compliance status, the controls we run, our sub-processors and our latest reports, all in one place and available on request.
Trust Center (Upcoming)Privacy handled properly
Your legal and compliance teams get what they need, without slowing the deal down.
GDPR compliant
Data Processing Agreement (DPA) available
A clear, published list of sub-processors
Customer content stored and hosted in the EU
Security questions?
We have answers
We are happy to share our security overview and DPA, complete your security questionnaire, and walk your team through the details.
Frequently Asked Questions
Is my deal data kept confidential?
Yes. Customer content is kept separate for each customer. Access is limited to authorised people and providers who need it to deliver and secure the service, is subject to confidentiality obligations, and is logged. We only show your content to people you invite and never to another customer.
Do you use my data to train your AI?
No. We do not use your documents, questions, comments, corrections or generated answers to train or fine-tune any AI model. Our model providers are contractually required not to train on your content.
Does the platform get better by using my data?
Not by training AI models on your content. We may use properly anonymised information to improve the service and produce aggregate market statistics, but only where it cannot identify you, your counterparties or your transactions.
Are you certified?
Our information security management system is built to ISO/IEC 27001:2022 and the SOC 2 Trust Services Criteria, and we operate to those standards today. Certification is in progress, and certificates and reports will be available under NDA once issued. We are happy to complete your security questionnaire.
Where is my data hosted?
Your documents are stored on servers in the European Union. Our team and the providers listed in our Sub-processor List may access them from elsewhere under the controls in our Security Measures. Data is encrypted in transit and at rest, each customer’s data is logically separated, and access is role-based and logged.
Can I see your ISO 27001 or SOC 2 compliance program or send a security questionnaire?
Yes. Many of our customers run IT procurement checks as part of their own security programs. We share documentation with prospects, work through questionnaires promptly, and are available to walk your team through the specifics.
What happens to my data if we stop working together?
You can export your documents, Q&A records and downloadable reports for 30 days after termination. We delete your content at the end of that period, subject to routine encrypted backup expiry and any legal retention requirements.
How do you keep the AI output reliable?
Our platform uses AI and produces probabilistic results. Every output is a draft that supports your team’s judgement rather than replacing it, and every finding is traceable to its source so you can check it. We recommend continuing to engage qualified counsel for bankable legal due diligence.