"Security & Assurance: our scans, drills and policies, in full"

What this page is

Security & Assurance is Verinode's own security record, shown to you in full because you are a member. It holds every finding of our weekly automated scan with its status and the decision we made about it, every restore drill with the gaps it found and how each was closed, the security tradeoffs we accept and why, the routines we keep beside the evidence that we kept them, and our security policies. Nothing on this page is your firm's data, so everyone on your team can open it, whatever their role.

Where to find it

Open Settings and, in the Data & Privacy group, click Security & Assurance, or go directly to /settings/security-assurance. Privacy & Legal carries a row that opens it too. In HQ it is under Settings › Data & Privacy.

What is held back, and why

Three things are not on this page, and the page says so where each would be:

• Names of keys, storage and accounts. A policy or drill record that names one reads "the root key" or "the backup storage" instead. Those names would shorten an attacker's path and tell you nothing you need.
• The exact location of an open finding. While a finding is open, you see its name, how serious it is, which surface it is on and what we decided. The URL and what the scanner saw are added when the fix ships. The scanner's full report is released the same way, once none of its findings are open.
• What other rules already protect. Other members' data, and the minimum group sizes behind peer benchmarks, are never shown.

The sections

• Security package. Download the whole record as one file for your own review or a reviewer you work with, or send us your security questionnaire.
• Scans. Every Monday an automated scanner reads the public pages of the app and the marketing site. It does not sign in or send attack traffic, and it is not a penetration test. The latest scan opens to its findings.
• Restore drills. We restore a real backup into a throwaway database and check that it opens and decrypts. Each drill lists what ran, what did not, and every gap.
• Accepted limitations. Each security tradeoff with its reason. An open one is a fix in progress.
• Commitments and their record. Each routine beside its last run. A missed run shows as Missed, and a routine with no record yet shows as Not yet run.
• Policies and controls. Each policy downloads as a document. The control matrix maps every control to the SOC 2 Trust Services Criteria with its status.

For someone outside Verinode

A company evaluating Verinode can ask for the same package on our website. A person reviews each request, and an approved one gets a link that works for 30 days.