Home / Trust

Trust and data handling

Last reviewed 2026-07-07

An IT provider holds the keys to everything. This page says how we hold them. It is referenced by the terms of service and the privacy policy, and we will sign a business associate agreement or data processing agreement where your regulation requires one.

Access

Every engineer and analyst signs in with phishing-resistant multi-factor authentication from a managed, encrypted device. Access to a client's systems is scoped to the people assigned to that client, granted through a password manager with per-client vaults, and logged. Standing administrator accounts are separate from daily accounts and reviewed monthly.

People

Background checks before anyone touches a client system. Contractors sign the same confidentiality and acceptable-use terms as the principal and are offboarded from every vault and tenant the day an engagement ends.

Data handling

We hold the minimum: contact details, configuration, tickets, the security telemetry needed to judge an alert, and backups where the client buys them. Client data is not used to train models, sold, or shared beyond the sub-processors listed here. Backups are encrypted with keys the client holds a copy of.

Insurance

Technology errors and omissions and cyber liability insurance in force; certificates on request. Our own environment follows the Secure plan baseline and is tested annually.

Incidents

If an incident on our side affects a client, the client's named contact is told within 24 hours of confirmation, with what happened, what was affected and what we are doing, followed by a written report. New York breach-notification law and any business associate agreement govern the rest.

Offboarding

At the end of an engagement every credential is rotated and handed over, our access is removed from every tenant and device, documentation is exported in open formats, and backups are returned or deleted on the client's written instruction within 30 days, with a confirmation.

Vulnerability disclosure

Report a vulnerability in anything we operate to security@verifior.com. We acknowledge within two business days, do not pursue good-faith researchers, and credit fixes on request.

Sub-processors

Services we use to deliver the work, each under a contract covering confidentiality and security. Client contacts are told by email 30 days before one is added.

Contact

Security questions and vendor questionnaires: sales@verifior.com. Vulnerability reports: security@verifior.com (security.txt).