Security & Trust
VeriProof is built for regulated industries. Our security architecture combines cryptographic immutability, tenant isolation, and defense-in-depth controls so you can run high-stakes AI with confidence and retain evidence that third parties can verify.
Security contact: Discovered a vulnerability? Email security@veriproof.app. See our Responsible Disclosure policy.
What Makes VeriProof’s Security Different
Most AI governance platforms store audit logs in a traditional database. VeriProof adds multiple layers that competitors don’t:
| Layer | VeriProof | Typical competitor |
|---|---|---|
| Audit log storage | Blockchain-anchored (Solana CMT) | Database only |
| Enterprise deployment boundary | Customer-owned Azure subscription (Enterprise Federated) | Vendor-managed shared environment |
| Multi-tenant isolation | EF Core + PostgreSQL RLS | Application-layer only |
| Evidence verification | Independent (no VeriProof dependency) | Vendor-dependent |
| EU AI Act evidence | Auto-generated (Articles 9–17) | Manual / partial |
| GDPR erasure | Cryptographic (blockchain-compatible) | Delete row |
Security Architecture
Blockchain Anchoring
Every AI session captured through the Ingest API is anchored to a Solana Concurrent Merkle Tree (CMT). This creates a tamper-evident record that:
- Survives even if VeriProof’s infrastructure is unavailable
- Can be independently verified by anyone with the proof hash
→ Blockchain Anchoring Deep Dive
Enterprise Federated data boundary
Enterprise Federated deployments keep session content, operational storage, and key custody inside your Azure subscription. VeriProof’s hosted infrastructure receives only the commitment data required for blockchain anchoring and verification workflows.
Multi-Tenant Isolation
Customer data is isolated using two independent mechanisms applied in tandem:
- EF Core Global Query Filters — every database query is automatically scoped to the
requesting customer’s
CustomerIdat the ORM layer - PostgreSQL Row-Level Security — a separate database-enforced policy that rejects cross-tenant access even if the application layer is compromised
→ Multi-Tenant Isolation Architecture
API Authentication
API keys use a compound format (vp_cust_{slug}.{azure-component}.{secondary}) backed by
Azure Key Vault. Sandbox and production keys are distinct and cannot cross-contaminate.
Compliance Status
| Framework | Status | Details |
|---|---|---|
| EU AI Act (Articles 9–17) | ✅ Supported | Auto-generated evidence packages |
| NIST AI RMF | ✅ Supported | SDK annotations map to all four functions |
| HIPAA / PHI | ✅ Supported | PII masking + audit trail controls |
| GDPR | ✅ Supported | Cryptographic erasure, DPA available |
| SOC 2 Type II | 🔄 In Progress | Target: Q4 2025 |
| ISO 27001 | 📋 Roadmap | 2026 |
→ Compliance Details · Security FAQ
Infrastructure Security
- Encryption at rest: AES-256 via Azure Storage service encryption
- Encryption in transit: TLS 1.3 enforced on all endpoints
- Key Management: Azure Key Vault for all signing keys and secrets
- Secrets: Never hardcoded; bound to deployment context (fail-secure if context is missing)
- Access Control: Explicit deny-by-default; no implicit wildcard grants
Enterprise Security Features
| Feature | SaaS | Enterprise Federated |
|---|---|---|
| Data residency choice | Azure region selection | Customer-owned Azure tenant |
| Network isolation | VNet peering | Full private endpoints, no egress |
| Key custody | VeriProof-managed | Customer-owned Key Vault |
| Audit log access | Via portal | Direct PostgreSQL + blockchain |
| Processing location | VeriProof-managed Azure | Customer-owned Azure subscription |
Frequently Asked Questions
Can I verify a compliance record without going through VeriProof?
Yes. Every record includes a Merkle proof that can be verified against the Solana blockchain directly using standard Solana RPC tools. The verification algorithm is published on GitHub so there is zero vendor dependency for audit evidence verification.
What happens to compliance records if VeriProof is unavailable?
Records anchored to the blockchain remain permanently accessible. The Solana CMT is a public, decentralized ledger. Your auditor can verify records independently of VeriProof’s infrastructure status.
Is our AI data ever used for training VeriProof models?
No. Customer data is never used for any purpose outside of providing the contracted service. See our Privacy Policy and DPA.
How do you handle security vulnerabilities?
We operate a responsible disclosure program. Security researchers can report issues to security@veriproof.app. We aim to acknowledge reports within 24 hours and publish fixes within 90 days. See our full policy.