Security

The Service runs on established cloud providers (application hosting, managed PostgreSQL, and object storage) that maintain their own SOC 2 and ISO 27001 certifications and operate hardened, access- controlled data centers. We build on their security foundations rather than running our own hardware.

All traffic to and from the Service is encrypted in transit with TLS 1.2 or higher. Data at rest, including your screenshots in object storage and records in the database, is encrypted using AES-256.

Sign-in is handled by a dedicated identity provider, with SAML single sign-on available for Enterprise customers. Internal access to production systems is limited to the people who need it, granted on a least-privilege basis, and audited.

Every project belongs to a team, and all data access is scoped to that team. Requests are authorized on every read and write, so one customer can never reach another’s screenshots or results.

• internal service-to-service calls are authenticated with signed (HMAC) requests;
• secrets are stored in managed secret stores, never in source control;
• dependencies are monitored for known vulnerabilities and updated promptly;
• changes go through code review before reaching production.

Our managed database is backed up continuously with point-in-time recovery, and screenshots are held in durable, redundant object storage. We monitor the Service and are alerted to incidents automatically.

We collect only what we need to run the Service, isolate it per team, and delete it on request. Retention windows, sub-processors, and your data rights are described in our Privacy Policy. Your content is never used to train third-party models.

We operate in line with the UK GDPR, EU GDPR, and CCPA, and can provide a Data Processing Agreement on request. A SOC 2 Type II examination is planned; contact us for the current status and our security documentation.

If you believe you have found a security vulnerability, please report it to security@uiverify.ai rather than disclosing it publicly. We investigate every good-faith report, will not pursue legal action against researchers who act in good faith and avoid privacy violations or service disruption, and aim to acknowledge reports within three business days.