How we keep your data safe

Where your data lives

Primary customer data is hosted in Supabase EU Central (Frankfurt). Authorised Verivius personnel may access customer data from the UK or EEA where required to operate, support or secure the service. The full list of named sub-processors (the third-party services we use to host, send email from, and operate the platform) is published in the Privacy Notice for your procurement team to review.

Verification details

These are the details a buyer, data-protection lead or procurement reviewer can verify independently.

• Legal entity: Verivius Ltd, Company No. 17211492, registered in England and Wales.
• ICO register:registered with the Information Commissioner's Office. Registration number ZC144284. This is a public register entry, not ICO approval, certification or endorsement.
• Cyber Essentials: Cyber Essentials Basic is currently certified. BlockMark certificate ID db57ef6f-abdb-4110-a880-019897760887. Expires 2027-07-14. Scope: Whole organisation. View the certificate.
• Data residency: Supabase EU Central (Frankfurt) (eu-central-1).
• Cyber insurance evidence: Evidence of Insurance for Eligible Cyber Essentials Certificate Holders, issued by Sutcliffe Insurance Brokers Ltd to Verivius Limited. From 14 July 2026 to 14 July 2027. Certificate ID d37253b0-d24d-4a91-979d-4f8997551099; bespoke ID 0038321696. View evidence. This is the Cyber Essentials holder insurance evidence specifically. Verivius Ltd's wider business insurance (professional indemnity, public & products liability, and cyber & data protection) is summarised in the compliance status below.
• Sub-processors: the current list is in the Privacy Notice.

Who can access your data

Inside your provider account, only users you have invited and assigned roles to can read records. Role-based access controls govern what each user can do. The roles are Owner, Admin, Manager, Contributor and Viewer, and any of them can be restricted to named locations, which is how a multi-location provider keeps one site's records away from another's.

Verivius personnel may access customer data only for documented support, security or legal purposes. Access through the product is individually attributable: every action runs under that person's own account, and any change made within a customer's workspace is recorded in that workspace's audit trail.

Encryption

Your data is encrypted while it travels between your browser and our platform, and between our platform and every system we use to store or process it. Data at rest, in our database, is encrypted by the hosting provider. Where a procurement process needs the specific protocol versions or cipher suites in use, we will obtain the current attestation from the provider concerned rather than restate it second-hand.

Passwords are never stored in plain text; they are one-way hashed before storage. Payment card details are handled entirely by our payments provider; Verivius itself never sees card numbers.

Authentication

Multi-factor authentication is mandatory for every account permitted to access customer workspaces and customer data. It is enforced for all workspace roles, on every authenticated request rather than at sign-in only, and it cannot be switched off. TOTP via standard authenticator apps, with single-use recovery codes issued at enrolment.

Sessions are time-bounded: a session is ended after 24 hours, and after 8 hours without use. Deleting a workspace requires the account password to be re-entered plus a typed confirmation, in addition to an active session. Changing a subscription and exporting data are protected by the session and the role, not by a second password prompt. Failed-login attempts are rate limited at the Supabase Auth layer.

Backups and data retention

The Supabase Postgres instance is backed up daily, with the retention window provided by Supabase's plan. Verivius also takes its own independent encrypted backup of the database and of uploaded evidence each night, held with a second provider in Germany and encrypted with a key that provider does not hold, so a loss of the main hosting account is survivable. Those backups are overwritten on a rolling cycle and the restore is tested rather than assumed.

Retention while you are an active customer: indefinite for workspace data, per your provider's own retention policy. After account closure: 30 days available for export, then a further 30 days in which the workspace is switched off but can still be restored on request, then permanent deletion. The full retention table, including what is kept after closure and for how long, is in the Privacy Notice.

Breach notification

If we become aware of a personal data breach affecting your workspace data, we will notify you within 36 hours of becoming aware. That is a Verivius commitment to you and is separate from the statutory notification duties that fall on each of us under UK GDPR. The notification will include the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures we have taken or propose to take.

Your right to export

Every customer can export their workspace data at any time, in a structured, machine-readable format. The export is owner-only and covers every register, every record, every audit-log entry and every related metadata field, including the details of each uploaded file: its name, size, type, upload date and the record it belongs to. It does not contain the uploaded files themselves. Those are downloaded individually from the record they sit on, using the evidence link there. There is no charge and no waiting period.

Safeguarding

Verivius personnel are expected to recognise and act on safeguarding concerns that arise during on-site engagements or records review. Our written commitment to safeguarding children and adults at risk, including the escalation route and how to raise a concern with us directly, is set out on the safeguarding commitment page.

Sub-processor changes

If we plan to add a new sub-processor, we will give customers at least 30 days notice before onboarding. Customers can object during that window. The current sub-processor list is published in the Privacy Notice, alongside a changelog recording every addition, change and removal.

What happens if Verivius ceases trading

This is a reasonable question and one we expect from procurement teams. If Verivius Ltd ceases operating, every customer will receive at least 90 days notice in writing. During that window, the export function described above remains available, and customers retain the right to extract their full data set in the portable format. We will assist with handover to any successor platform of the customer's choosing.

The Companies Act 2006 governs the wind-up process for Verivius Ltd; data-processor obligations under UK GDPR continue through any wind-up.

Reporting a security issue

If you believe you have found a security vulnerability in Verivius, please email hello@verivius.co.uk with the subject line "Security" and a description of the issue. We will acknowledge within 3 working days and aim to triage within 5 working days. We do not yet run a formal bug bounty programme; responsible disclosure is rewarded with public credit (with your permission) and our genuine thanks.

Please do not publish the vulnerability until we have had time to investigate and fix it.

Current compliance posture

Verivius Ltd's own compliance status, kept honest and live. The page below reads from a single source of truth in the codebase, so the moment an item completes (Cyber Essentials certificate arrives, insurance evidence changes, DPIA is signed off) the dates ripple through every surface that shows them.