Trust
Verax, profiled by Verax
We ask you to send us log exports and identity data. It would be incoherent to audit how AI vendors handle data and not publish our own answers — in the same format, to the same standard, as every vendor profile we write.
Data-handling profile
- Trains on your input
- No.Your ingested logs and findings are never used to train any model, ours or anyone else's, and are never added to the public vendor dataset.
- What we collect
- Only what you send: log events (timestamp, destination hostname, source IP, username, byte counts) and, if you use the Entra importer, OAuth grant metadata. We never receive request or response content — no prompts, no files, no traffic decryption.
- Watch subscriptions
- Email address and the vendors you watch. Never shown publicly, never shared or sold. One-click unsubscribe in every alert.
- Data region
- EU. Application in Paris (cdg), database in the EU (eu-west-3).
- Retention
- Assessment data lives in your workspace until you replace it or ask for deletion; each ingest replaces the previous run. Deletion on request, no retention floor.
- Isolation
- Every client has a private workspace keyed to their API key. Findings are scoped per workspace; there is no cross-tenant read path.
- Sub-processors
- Vercel (application hosting), Supabase (EU Postgres), Brevo (alert email delivery), Google Gemini (classifies changes in public vendor documents — never your data).
- Your data and the LLM
- No customer data is ever sent to any language model. The only text an LLM sees is publicly published vendor policy documents we fetched ourselves.
- Deployment options
- EU-hosted SaaS today. Self-hosted ingestion for organisations that will not send logs off-premises — ask us.
- Exportability
- Your findings are yours: every assessment surface is available over the API (JSON, OCSF, CEF) and as a report you can export at any time. No lock-in, no export fee.
- Status
- Independent product, sole operator. No SOC 2 or ISO 27001 audit yet — stated plainly rather than implied. If a certification is a requirement for you, tell us and we will say honestly where we are.
Why this page exists
Our methodology says unverifiable facts are marked unknown rather than guessed. The same rule applies to us: everything above is what we actually do, including the parts that are not flattering.