Security at Verazify

All data exchanged with the Service travels over encrypted connections using TLS. Data at rest — including identity document images, biometric data, extracted fields, and screening results — is encrypted using AES-256. Encryption keys are managed through our cloud providers’ key-management services with restricted access and rotation practices.

Verazify runs on established cloud infrastructure rather than self-managed hardware, so we inherit strong physical and environmental security from our providers and focus our effort on the application and data layers.

• Amazon Web Services (AWS) — compute, storage, and identity/biometric processing components.
• Supabase — managed PostgreSQL database and authentication.
• Vercel — application hosting and global content delivery.

A full list of the providers that process data on our behalf is published on our Sub-processors page.

Access to production systems and customer data is granted on a least-privilege, need-to-know basis. We enforce unique accounts, require multi-factor authentication for administrative access, and log access to production environments. Internal access is reviewed periodically and revoked promptly when no longer required.

Our services are protected by network segmentation and firewalls, and the API enforces rate limiting and abuse protection to guard against automated attacks, credential stuffing, and denial-of-service attempts. Suspicious traffic patterns are monitored and throttled, and authentication and security controls cannot be bypassed by exceeding published limits.

Biometric data is among the most sensitive data we handle, and we apply heightened safeguards:

• it is encrypted in transit and at rest and subject to strict access controls;
• it is used only to perform the face-match and liveness checks a customer requests — never to build facial-recognition databases or for unrelated purposes;
• it is retained only for short, configurable windows and then deleted or de-identified; and
• customers, as controllers, are responsible for obtaining the explicit consent required before biometric data is submitted, as described in our Privacy Policy.

We maintain centralized logging, monitoring, and alerting across our infrastructure to detect anomalous or unauthorized activity, and we operate a documented incident-response process so that potential issues are triaged and addressed promptly. Encrypted backups and redundancy across availability zones support recovery and continuity.

We welcome reports from security researchers and treat responsible disclosure as a partnership. If you believe you have found a vulnerability in Verazify, please report it to us and give us a reasonable opportunity to investigate and remediate before any public disclosure.

We are transparent about where we are on our compliance journey. The following reflects our current status. Items marked “in progress” or “planned” are on our roadmap and are not yet held.

For security questions, disclosures, or to request our current security documentation, contact our security team.