Skip to content
Analyze

TRUST CENTER

Built so we can't betray you.

Verification only works if the verifier is trustworthy. These are the controls in the current service design; planned audits are identified separately and are not presented as certifications.

Ephemeral processing

Uploads use a per-request temporary workspace on the analysis service. Cleanup removes media after successful and handled-failure requests, and media is not written to the account database or used for training. Social-link retrieval can involve the named platform and extraction providers listed below.

Authenticated results

Every analysis result is sealed by the backend with authenticated encryption (ChaCha20-Poly1305) before it travels back through the browser. A tampered or replayed result is rejected — the score you see is the score the engine produced.

Single-use upload tickets

Uploads are authorized by short-lived, HMAC-signed, single-use tickets minted per analysis. A leaked ticket expires in minutes and cannot be replayed.

Payments we never see

Billing runs through Paddle as merchant of record. Card numbers never reach Verifyco systems; we store only the plan, credit balance and transaction references needed for your account.

Hardened account security

Passwords are bcrypt-hashed; verification and reset tokens are stored hashed and are strictly single-use; sensitive changes revoke all outstanding sessions; sign-in and abuse-prone endpoints are rate limited.

Private-by-default reports

Reports belong to your account only. Sharing is explicit opt-in and exposes a redacted scoreboard — never your detailed findings — behind a revocable, unguessable link.

WHAT WE STORE — AND WHAT WE NEVER DO

Stored (minimum necessary)

  • · Account: email, name, sign-in provider, bcrypt password hash if set.
  • · Analysis reports: the JSON verdict and layer findings — never the media.
  • · Billing: plan, credit ledger and Paddle transaction references.
  • · Operational signals: bounded delivery/error events with internal identifiers, never media.

Never

  • · No application-level persistent media library; request workspaces are temporary.
  • · No training of models on user content.
  • · No sale or sharing of personal data; no third-party ad trackers.
  • · No card data — Paddle (merchant of record) handles all payment details.

INFRASTRUCTURE & SUBPROCESSORS

  • Vercelweb application hosting (TLS everywhere)
  • Renderanalysis compute and per-request temporary media
  • NeonPostgres database (accounts, reports, billing state)
  • Paddlemerchant of record — payments, tax, invoices
  • RevenueCatApp Store subscription check for accounts that sign in with Apple
  • Google Workspacetransactional email
  • ApifyInstagram extraction when the platform requires it
  • TikWMTikTok public-media resolution fallback
  • FXTwitterserver-side X preview metadata fallback
  • OpenAIContent Provenance API check of analyzed images for OpenAI's own provenance signals
  • Sign-in providersauthentication only when you choose that provider

Each processes only what its role requires. Details in the Privacy Policy.

COMPLIANCE — HONESTLY STATED

  • In effect: GDPR & KVKK alignment — self-serve access, correction and erasure (delete individual reports or your whole account, including for social sign-ins); EU-style consumer rights honoured in our Refund Policy.
  • In effect: Encrypted transport (TLS 1.2+) end to end; authenticated result sealing; secrets held in platform vaults, never in the repository.
  • Roadmap: SOC 2 and ISO 27001 audits are planned as the company grows. We do not display badges for audits we haven't passed.

Found a vulnerability?

We welcome good-faith security research. Report issues to support@verifyco.app with reproduction steps — we respond within 2 business days and will credit verified reports if you wish.