Compliance FAQ
What compliance evidence can my team review?
Available evidence depends on the product release, deployment, and approved disclosure terms. Use your enterprise diligence contact to request the current evidence package.
The package may include approved architecture material, control responses, and release-specific security evidence. The document itself defines its scope and review period.
Does VeriProof have a SOC 2 Type II report?
The SOC 2 page explains how to request current report status. Confirm the report’s dates, scope, and disclosure terms during vendor review.
Is VeriProof certified to ISO 27001?
Confirm the current certification status during vendor review. Product controls and a future certification plan are not substitutes for an issued certificate.
How does VeriProof support the NIST AI RMF?
VeriProof can capture evidence for selected GOVERN, MAP, MEASURE, and MANAGE practices. The NIST AI RMF mapping identifies the relevant product features.
Your organization selects the framework profile, risk methods, measures, owners, and acceptance criteria.
Where is customer data stored?
Data location depends on the approved deployment and its Azure configuration. Review the selected region, replication settings, proof provider, and support access during solution design.
See Deployment overview for the supported operating models.
Can I request a DPA or BAA?
Use the enterprise inquiry form to confirm the agreement available for your use case. Do not send personal data or protected health information until the required agreement and deployment controls are approved.
Does VeriProof make my system GDPR or HIPAA compliant?
No product establishes compliance on its own. VeriProof provides governance, access, retention, export, and integrity controls that may support your program.
Your organization remains responsible for legal scope, configuration, operating procedures, and required agreements. See GDPR and HIPAA and PHI handling.
Does VeriProof complete EU AI Act obligations?
VeriProof can support monitoring, review, record-keeping, and evidence workflows. It does not replace your risk management system, technical documentation, human oversight, conformity assessment, or legal analysis.
See the EU AI Act mapping for feature-level guidance.
Can my team test VeriProof security?
Security testing requires written authorization and an approved scope. See Penetration testing and Responsible disclosure.
Who can answer a vendor questionnaire?
Send the questionnaire through your enterprise diligence contact. Include the deployment model, data types, required frameworks, decision date, and requested evidence period.