Security FAQ

Use these answers to prepare a security review. Confirm deployment-specific details with the responsible owner and request evidence for the version you intend to use.

Data protection

Is stored data encrypted?

Azure data services provide managed encryption at rest. VeriProof also protects supported captured content according to the selected SDK, tenant, and deployment configuration.

During diligence, identify each data store, its encryption settings, and its key owner. Do not assume a field has application-level encryption unless the data-flow documentation confirms it.

Is data encrypted in transit?

Supported external endpoints use HTTPS. Database and Azure service connections must use the secure transport required by the release architecture.

Validate certificates, minimum protocol settings, private connectivity, and every outbound dependency in the target environment.

Who owns encryption keys?

Key ownership depends on the operating model. VeriProof owns managed-service keys within its service boundary. Customer-managed Azure customers own their Key Vault policy and the supported key material placed there.

Name the owners for key rotation, recovery, deletion, and emergency access. Also agree on how the deployment selects a key version.

Evidence integrity

Which proof providers does VeriProof support?

A deployment can use Solana or Azure SQL Ledger.

Solana records a public proof reference. Azure SQL Ledger uses append-only ledger tables and protected database digests. Azure SQL Ledger is not a public blockchain.

Does an anchored status prove the export is valid?

No. The status reports what VeriProof recorded. Export the evidence pack and run veriproof-verify for an independent check.

Can an auditor verify without a VeriProof API key?

Yes. The public verifier does not accept a VeriProof application key and does not call a VeriProof API.

A Solana verification requires suitable RPC access. Azure SQL Ledger verification requires an authorized Azure SQL connection and access to protected digests.

What do proof-provider fees cost the customer?

Costs depend on the deployment and commercial agreement. For Customer-managed Azure, identify which proof-provider resources run in your subscription and include them in the deployment cost review.

Verification access is a separate question. Confirm the selected provider, what data is public, and which credentials or infrastructure the verifier needs.

Access and isolation

How does VeriProof separate customer data?

Services apply authenticated tenant, role, application, and audit-engagement scope. Database policies and grants add boundaries for supported stores.

Review the deployed roles, privileged bypass paths, support access, and authorization tests. Do not treat a general architecture description as proof that a specific deployment is configured correctly.

Can VeriProof staff access customer records?

Access depends on the operating model, staff role, support process, and customer configuration. Privileged access must be limited, authorized, and logged.

Customer-managed Azure customers should agree on any support access before deployment.

Keys and authentication

How are application SDK keys stored?

VeriProof shows the full secret when the key is issued. Authentication uses a stored hash; the plaintext secret is not retained for later display.

Store the secret in an approved secrets manager. Rotate and revoke it through the application-key workflow.

Can one key be used across applications?

Application SDK keys are application-scoped. Create a separate key for each application and environment boundary required by your operating model.

Retention and deletion

How long is data retained?

Administrators configure supported retention periods in Settings → Privacy & data → Retention policy. Contract terms, legal holds, and deployment controls can further limit deletion.

Proof references are separate from retained session content. Confirm the selected provider’s deletion boundary before approving a retention policy.

What happens when an organization is deleted?

Organization deletion is a controlled workflow. Scope, approvals, legal holds, retained proof references, and completion evidence depend on the deployment and contract.

Keep the request, authorization, result, and verification evidence for the affected organization.

Assurance and legal terms

How do I confirm the current SOC 2 report status?

Request the current status and approved evidence through your enterprise diligence contact. An issued report defines its scope and examination period.

Does VeriProof certify that a customer complies with a framework?

No. Framework mappings and evidence exports support the customer’s review. The customer, its counsel, auditors, and relevant authorities determine scope and compliance.

Can VeriProof process regulated health data?

The answer depends on the executed agreement, deployment, enabled capture, and customer safeguards. Do not send protected health information based on this FAQ.

Confirm the current contract and security requirements with the authorized VeriProof contact and your privacy and legal teams.

Report a security concern

Follow Responsible disclosure for sensitive vulnerability reports. Use the security review form  for enterprise diligence.