Security
Security is at the core of everything we do at Verdic. This page outlines our security practices, infrastructure, and commitment to protecting your data.
At Verdic, we understand that security is paramount when handling AI-generated content and validation data. We implement multiple layers of security controls, industry-standard encryption, and rigorous access controls to protect your information.
All data encrypted in transit and at rest
Regular security audits and assessments
Following industry best practices
Encryption in Transit
All data transmitted between your systems and Verdic's API is encrypted using TLS 1.3, the latest and most secure version of the Transport Layer Security protocol. This ensures that your validation requests and responses cannot be intercepted or tampered with during transmission.
- TLS 1.3 with strong cipher suites
- Perfect Forward Secrecy (PFS)
- Certificate pinning for enhanced security
- Automatic protocol negotiation
Encryption at Rest
All data stored in our databases and backup systems is encrypted using AES-256, the industry-standard encryption algorithm. This includes:
- User account information and profiles
- Validation logs and request data
- API keys (hashed using bcrypt)
- Configuration and settings
- Backup files and archives
Key Management
Encryption keys are managed using secure key management systems with strict access controls. Keys are rotated regularly and stored separately from encrypted data.
API keys are a critical component of authentication and access control. We implement multiple security measures to protect your API keys:
- Hashing: API keys are hashed using bcrypt before storage. We never store plaintext API keys.
- Prefix Display: Only the first few characters of your API key are displayed for identification purposes.
- Regeneration: You can regenerate API keys at any time, immediately invalidating the old key.
- Revocation: API keys can be revoked instantly through your dashboard.
- Rate Limiting: API keys are subject to rate limits to prevent abuse and ensure service availability.
- Usage Monitoring: All API key usage is logged and monitored for suspicious activity.
Best Practices
To keep your API keys secure:
- Never share API keys in public repositories or client-side code
- Store keys in environment variables or secure secret management systems
- Rotate keys regularly, especially if you suspect they may have been compromised
- Use separate API keys for different projects or environments
- Monitor your API key usage for unexpected activity
Cloud Infrastructure
Verdic's infrastructure is hosted on leading cloud providers with enterprise-grade security certifications. Our infrastructure includes:
- Secure, geographically distributed data centers
- Redundant systems and automatic failover
- DDoS protection and mitigation
- Network segmentation and firewalls
- Intrusion detection and prevention systems
- Regular security patches and updates
Access Controls
Access to our production systems is strictly controlled:
- Multi-factor authentication (MFA) required for all administrative access
- Role-based access control (RBAC) with least-privilege principles
- Regular access reviews and audits
- All access attempts are logged and monitored
- VPN and secure tunnel requirements for remote access
Monitoring and Logging
We maintain comprehensive logging and monitoring:
- Real-time monitoring of system health and performance
- Security event logging and alerting
- Audit logs for all administrative actions
- Anomaly detection for suspicious activity
- 24/7 monitoring and incident response capabilities
Data Minimization
We collect and store only the data necessary to provide our validation services. We do not retain validation data longer than necessary, and you can request deletion of your data at any time.
Data Isolation
Each customer's data is logically isolated within our systems. We use database-level access controls to ensure that customers can only access their own data.
Backup and Recovery
We maintain regular, encrypted backups of all data. Backup systems are tested regularly to ensure data integrity and recoverability in the event of a disaster.
- Automated daily backups with multiple retention periods
- Geographically distributed backup storage
- Regular backup restoration testing
- Point-in-time recovery capabilities
Data Processing
Validation data is processed solely for the purpose of providing validation services. We do not use your validation data to train models or improve our algorithms without your explicit consent. Aggregated, anonymized data may be used for service improvement and analytics.
Secure Development
Security is integrated into our software development lifecycle:
- Code reviews with security focus
- Automated security scanning in CI/CD pipelines
- Dependency vulnerability scanning
- Secure coding standards and practices
- Regular security training for development team
Authentication and Authorization
We implement robust authentication and authorization mechanisms:
- Secure password policies and password hashing
- Multi-factor authentication (MFA) support
- API key-based authentication for programmatic access
- Session management with secure tokens
- Role-based access control throughout the application
Input Validation and Sanitization
All user inputs are validated and sanitized to prevent injection attacks, XSS, and other security vulnerabilities. We implement:
- Input validation and type checking
- Output encoding and sanitization
- SQL injection prevention
- Cross-site scripting (XSS) protection
- Rate limiting and abuse prevention
We follow industry best practices and security standards:
- OWASP Top 10: We address all OWASP Top 10 security risks
- GDPR Compliance: We implement data protection measures in accordance with GDPR requirements
- Data Residency: We respect data residency requirements and can discuss specific arrangements for Enterprise customers
- Security Audits: Regular internal and external security audits
While we follow these standards, we are continuously working toward obtaining formal certifications (such as SOC 2, ISO 27001) as we scale.
We have established incident response procedures to quickly identify, contain, and remediate security incidents:
- 24/7 monitoring and alerting systems
- Incident response team with defined roles and responsibilities
- Rapid containment and remediation procedures
- Customer notification process for data breaches
- Post-incident review and improvement processes
Report Security Issues
If you discover a security vulnerability, please report it responsibly:
Email: hello@verdic.dev
Please include a detailed description of the vulnerability and steps to reproduce it. We will investigate and respond promptly.
We work with trusted third-party service providers who maintain high security standards:
- Cloud Providers: Enterprise-grade cloud infrastructure with security certifications
- Payment Processors: PCI DSS compliant payment processing (e.g., Stripe)
- Analytics: Privacy-focused analytics providers with data processing agreements
- Email Services: Secure email delivery with authentication and encryption
All third-party vendors are subject to security assessments and must meet our security requirements through contractual agreements.
Security is a shared responsibility. Here are some best practices to help keep your account and data secure:
- Strong Passwords: Use unique, complex passwords for your account
- Enable MFA: Use multi-factor authentication when available
- Secure API Keys: Store API keys in environment variables, never in code repositories
- Regular Rotation: Rotate API keys regularly, especially if compromised
- Monitor Usage: Regularly review your API usage logs for suspicious activity
- Access Control: Use separate API keys for different projects or environments
- Keep Software Updated: Ensure your integration code and dependencies are up to date
- Secure Connections: Always use HTTPS when making API requests
If you have security-related questions or concerns, please contact us:
Email: hello@verdic.dev
Security Issues: Please use the email above with the subject line "Security Issue" for faster response
General Contact: Contact Page