Privacy Policy

1 Who we are

Veritio Cloud is a hosted audit-trail and compliance-evidence service operated from Germany. For account and security data described in this policy, we act as the data controller under the EU General Data Protection Regulation (GDPR).

The controller within the meaning of Art. 4(7) GDPR for the personal data described in this policy is Yan Malinovskiy(sole proprietor), Belchenstraße 2, 79276 Reute, Germany,hello@getveritio.com. No Data Protection Officer is appointed; the thresholds of Art. 37 GDPR and § 38 BDSG are not met at the current scale of processing. Direct all privacy inquiries to the controller at the address above. See also the Imprint.

2 Two roles: controller and processor

It matters which data we mean. For the personal data in youraccount — the data needed to run the service and keep it secure — Veritio is the controller, and this policy governs it. For the evidence records your applications and agents send into your tenant, Veritio is a processoracting on your instructions; you are the controller of that data, and our Data Processing Agreement governs it.

3 Account data we process

As controller, we process:

• Identity and contact data — your email address, your name if you provide it, and your membership in an organization — processed to create and operate your account, verify your email, send team invitations, and communicate with you about the service.
• Authentication data — a securely hashed password and email-verification state — processed to authenticate you and protect your account.
• Security audit data — including IP addresses and timestamps of sign-in and sensitive account actions — processed to detect and investigate abuse, secure the service, and keep a security record. We keep this to what is needed for that purpose.
• Billing data — once billing is live, subscription and payment status. Card details are handled by our payment processor, Polar, and are not stored by Veritio.

Consistent with how the product is designed, we prefer stable identifiers over unnecessary personal data and do not seek freeform personal data we do not need.

4 Why we process it (legal bases)

• Performance of a contract (Art. 6(1)(b) GDPR) — to provide the service under our Terms, including creating your account, authenticating you, and handling invitations and billing.
• Legitimate interests (Art. 6(1)(f) GDPR) — to secure the service, prevent and investigate abuse, and keep security audit records, balanced against your rights.
• Legal obligation (Art. 6(1)(c) GDPR) — to meet retention, tax, and lawful-request obligations that apply to us.

5 Subprocessors

We use a small set of infrastructure providers to run the service. Each is bound by data-protection terms, and each processes data only to provide its part of the service.

We maintain this list current and give notice of material changes as described in the Data Processing Agreement.

6 Where data is stored

You choose the region where your tenant evidence data is stored — theEU, the US, or APAC. For the EU region, we commit to an EU jurisdiction guarantee on object storage. Tenant databases run on Neon (on Amazon Web Services) and compute and object storage run on Cloudflare, each pinned to your chosen region. Where personal data is transferred outside the EEA, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses.

7 Cookies & website analytics

Veritio Cloud uses only strictly necessary cookies to keep you signed in and to secure the session. We do not use advertising cookies or cross-site tracking.

On this website (getveritio.com) we measure aggregate traffic withUmami (Umami Software, Inc., EU-hosted). Umami is cookieless and stores no personal identifiers; we see only aggregate statistics such as page views, referrers, and approximate location derived from your IP address (country and city — the IP address itself is not stored).

With your consent — asked once via the cookie banner — we additionally use Google Analytics 4 (Google Ireland Limited, with Google LLC in the US as sub-processor under the EU-US Data Privacy Framework). Google Analytics sets cookies and processes usage data to report how visitors use the site. It does not load unless you accept, and you can withdraw consent at any time via “Cookie settings” in the footer, which stops further data collection and removes its cookies.

8 Retention

We keep account data for as long as your account is active and for a limited period afterward to meet legal obligations and resolve disputes, then delete or de-identify it. Security audit data is kept only as long as needed for security and legal purposes. Retention of tenant evidence data is governed by your instructions and theData Processing Agreement.

9 Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to lodge a complaint with a supervisory authority. Where we act as processor for tenant evidence data, please direct data-subject requests to the customer who controls that tenant; we will assist that customer as described in the Data Processing Agreement.

10 Not legal advice

Veritio supports compliance evidence workflows. It does not provide legal advice and does not guarantee that your use of the service is compliant with the GDPR or any other framework.

11 Contact

To exercise a right or ask a privacy question, contacthello@getveritio.com.