Built like the evidence layer it is

Every table in Verity is tenant-scoped, and tenant context is resolved per-request from verified authentication — never from an environment default on the request path. If tenant resolution fails, the request fails closed: no data is served rather than the wrong tenant's data. Route access is default-deny — the only unauthenticated surface is the published-content showcase; every operational route requires an authenticated, tenant-bound identity.

Cross-tenant reads do not exist in the product surface. Staff-level aggregation is treated as a security-sensitive project in its own right, not a convenience feature.

The audit spine is the product: configuration and business events land in an append-only audit log, compliance checks record the exact policy version that ran (policy versions are immutable once promoted), and every claim in generated content is stored with its citations. Published assets carry a public Trust Certificate — a content-hashed, per-version record of sources, checks, and reviewer sign-off. The certificate attests that content has a verifiable trust record; it does not assert absolute truth, and its disclosure footer is non-configurable by design.

Approval decisions record who decided, what they saw, and whether a compliance gate was in force. Compliance-forced holds cannot be bulk-approved or silently bypassed — release requires an explicit per-item human decision.

Verity processes your brand configuration, editorial content, cited public sources, and the platform credentials you connect. We maintain a strict no-PHI policy: Verity is not a HIPAA business associate, does not accept protected health information, and our terms prohibit submitting it. Wellness content operates under DSHEA/FTC advertising lenses, not clinical data handling.

Secrets and provider errors are redacted before they are stored or alerted on — token-shaped strings never land at rest in job records or operational alerts.

All traffic is TLS in transit. Data at rest lives in managed services (Neon PostgreSQL, Vercel storage) that encrypt at rest as a platform property. The render runtime is a hardened single-purpose host reached only through an authenticated tunnel; there is no inbound port exposure. Scheduled and background work is authenticated with dedicated secrets, and operational failures page the operator through a monitored alerting pipeline.

Channel credentials are per-tenant, bring-your-own-app keys: your platform tokens authorize your developer application, scoped to the accounts you connect. They are stored server-side, never exposed to the browser, and redacted from logs. Our secrets-management roadmap moves all platform and tenant credentials to a central encrypted source of truth with envelope encryption for tenant keys and automated connection-health monitoring — this work is specified and scheduled, and we say so here rather than claiming it early.

Verity is an early-stage product and we don't claim certifications we don't hold. SOC 2 is on our roadmap, gated to begin with our first production customers, and this page will state the engagement status when — and only when — it is real. In the meantime, everything above is verifiable in a technical review, and we welcome one.

Found a vulnerability? Email security@veritypress.ai. We commit to acknowledging reports within two business days and to not pursuing good-faith researchers.