Last updated: 4 May 2026
Verityx is designed for organisations that handle sensitive vendor and delivery data. Our security controls reflect the expectations of enterprise procurement, IT governance, and legal teams. This page summarises our current security posture and the controls we maintain.
Verityx connects to your project management and source control systems using read-only API credentials or OAuth scopes. The platform cannot create, modify, or delete any data in your systems. Specifically:
Each client engagement operates within a logically isolated tenant. Isolation controls include:
In transit: All data is transmitted over TLS 1.2 or higher. API endpoints enforce HTTPS. No plaintext connections are accepted.
At rest: Audit data is encrypted at rest using AES-256 encryption via the infrastructure provider's managed encryption service.
Default retention period is 90 days after the final report is generated. Retention is configurable per engagement. Clients may request immediate deletion of all audit data at any time. Deletion requests are processed within 48 hours and confirmed in writing.
Verityx runs on managed cloud infrastructure with the following characteristics:
Verityx is pursuing SOC 2 Type II certification. Current controls are mapped to the Trust Services Criteria framework across security, availability, and confidentiality. We expect to complete the observation period and receive our report in Q3 2026. Prospective clients may request a summary of current controls mapped to TSC criteria.
If you believe you have found a security vulnerability in Verityx, please report it to security@verityx.io. We will acknowledge receipt within 24 hours and provide an initial assessment within 5 working days.
For security questions or to request a controls summary: security@verityx.io