Security

VerifyStack holds confidential plant evidence for firms that compete with each other. The design assumes that a mistake in one place must not expose another firm's data, and that the record of a verification must not be changeable after the fact.

• Every tenant table carries the owning firm and is protected by row-level security.
• Signed-in users can read their own firm's rows. Writes go only through server routes that check the user's role and firm.
• Four roles share one capability map used by the menu, the page and the route.

• Audit events, facts, calculation runs and sign-offs are append-only. Updates and deletes are refused at the database, for every role.
• Each calculation run records the engine version, pack version and an input hash, and is chained to the one before it.
• Sign-off needs two different people. It is refused while a blocking finding is open or while a required technical review is missing or out of date.

• Files are hashed on arrival and kept in a private store under that hash.
• The type of a file is read from its contents, not from what the browser claims, and only a short list of document and image types is accepted.
• Downloads are authorised per request and are never cached publicly.
• Entity response links are single-use, signed, time-limited and bound to one issue.

• Email sign-in requires confirmation. Firm invitations are signed and bound to one email and role.
• Signup can be restricted to invited users or to listed email domains.
• Rate limits apply to sign-up, invitations, response links and every route that calls a model.

When enabled, evidence pages and finding text are sent to the Google Gemini API for extraction and drafting. Model output is stored as a suggestion for a person to accept, and is never used as a number in a calculation.

State-changing requests from other sites are refused, responses carry anti-framing and content-type protections, and production traffic is served over HTTPS with strict transport security.

Please do not open a public issue. Tell us what you found, how to reproduce it and what you think the impact is, and give us a reasonable time to fix it before you share it.

Use the request form and say that it is about a security report.

We are an early product and have not yet had an independent security audit or certification. We track the controls we have not built yet, and we will discuss them with any firm that asks before it onboards.