PLATFORM PRIVACY

Platform privacy notice

Last updated: August 20, 2026

This notice explains how Veriqora handles personal information when people access or use the Veriqora platform, contact support, or interact with platform-related services.

1. Scope and roles

This notice applies when Veriqora determines why and how personal information is processed, such as account administration, service security, support, and service communications. Organizations using Veriqora generally control the records, evidence, personnel data, and other content placed in their workspaces. For that Customer Data, Veriqora acts on the customer’s instructions as a processor or service provider, subject to the customer agreement and any data processing addendum.

2. Information we collect

Account and profile information

We may process a user’s name, business email, organization, role, identity-provider subject, authentication status, preferences, and account recovery information.

Workspace and assurance information

Customers and users may provide policies, risks, controls, evidence, audit records, findings, tasks, reports, personnel and vendor information, comments, approvals, and other records needed for assurance workflows. Customers decide what they submit and who can access it.

Integration information

When authorized, the platform may receive cloud account identifiers, resource configuration, identity and access metadata, security findings, audit or configuration events, collection timestamps, and connection health information from AWS or other connected services. Veriqora does not require static AWS access keys where delegated role access is supported.

Technical and usage information

We may process IP address, browser and device information, session identifiers, authentication events, requested routes, timestamps, error and diagnostic records, security events, and audit logs. We also record changes and actions needed to preserve accountability within a customer workspace.

Support and communications

We process information submitted in support requests, emails, meetings, security reports, and other communications, including attachments or screenshots a person chooses to provide.

3. How we use information

We use personal information to provide and secure the service; authenticate users; enforce tenant and role boundaries; operate evidence, audit, integration, and reporting features; respond to support; maintain service and audit records; diagnose failures; prevent misuse; improve functionality; communicate operational or contractual information; and comply with law. We do not use Customer Data to make independent compliance determinations for a customer.

4. Legal bases

Where applicable law requires a legal basis, processing may be necessary to perform a contract, comply with legal obligations, protect users and the service, or pursue legitimate interests such as service delivery, security, support, and improvement. We rely on consent where required. A customer is responsible for establishing the legal basis for personal information it places in its workspace.

5. How information is disclosed

We may disclose information to infrastructure, identity, security, communications, support, and professional-service providers that help operate Veriqora; to integrations selected by a customer; within the customer organization according to configured access; in connection with a corporate transaction subject to appropriate safeguards; or when required to protect rights, safety, the service, or comply with law. We do not sell personal information or share it for cross-context behavioral advertising.

6. Subprocessors and third-party services

The platform uses service providers, including cloud infrastructure and identity services, to deliver its functions. Customers should review the current subprocessor disclosures and any applicable agreement for approved providers and processing locations. Third-party integrations have their own terms and privacy practices.

7. Retention and deletion

We retain account, workspace, integration, support, security, and audit information for the periods needed to provide the service, meet the customer agreement, maintain evidence integrity, resolve disputes, protect the service, and comply with law. Retention may vary by record type and customer configuration. Following termination, Customer Data is returned or deleted according to the applicable agreement, subject to backups, legal holds, and records Veriqora must retain by law.

8. Security

Veriqora uses safeguards designed to protect confidentiality, integrity, availability, and tenant separation, including access controls, encryption, audit logging, secure development practices, and restricted service roles. Security depends on shared responsibility: customers must manage users, roles, endpoints, integrations, exports, and the data they choose to submit. No method of transmission or storage is completely secure.

9. International processing

Information may be processed in countries where Veriqora or its approved service providers operate. When required, Veriqora will use recognized transfer safeguards. No specific data-residency commitment applies unless it is documented in a signed customer agreement.

10. Privacy rights and choices

Depending on location, individuals may have rights to access, correct, delete, restrict, object to, or obtain a portable copy of personal information, withdraw consent, or appeal a decision. For information controlled by an employer or another Veriqora customer, requests should normally be directed to that organization first. Veriqora will assist customers with verified requests as required by contract and law. Requests may also be sent to hello@getveriqora.com.

11. Children

The platform is intended for business use and is not directed to children. Users must be at least 16 years old or the minimum age required by applicable law. If we learn that personal information was submitted unlawfully by a child, we will take appropriate steps to delete it.

12. Changes and contact

We may update this notice to reflect changes in law, service features, providers, or data practices. We will update the date above and provide additional notice of material changes when required. Questions and privacy requests may be sent to hello@getveriqora.com.