Security
How Verinten protects your workspace
This page describes controls that are implemented, not aspirations. Where something is planned rather than built, it says so.
Tenant isolation
Separation by construction
- Every tenant-owned record carries a tenant identifier, and every query is scoped by it.
- Tenant access is resolved server-side from the session — never inferred from a URL and never trusted from the browser.
- Every stored object key and every background job message is prefixed with the owning tenant.
- Cross-tenant access attempts are covered by automated tests, not only by review.
Platform
Infrastructure controls
- The application runs on Cloudflare Workers at the edge, with per-environment isolated data stores.
- Object storage is private; nothing is publicly addressable, and downloads go through authenticated routes or short-lived signed links.
- Secrets are held in the platform secret store, never in the repository, never in client-visible configuration.
- Internal administration is protected by an identity gateway in addition to application authorization.
- Rate limiting and bot protection are applied at the edge on public and API surfaces.
Data
What we hold, and what we refuse to
- No patient data is collected, stored, or inferred — this is a product boundary, not a configuration.
- Only public sources are read; nothing behind a login is collected.
- Reviewer names are minimised in analytical screens.
- Product analytics is disabled until consent, with autocapture off and session replay a separate, maximally masked choice.
- Data export and deletion are self-service, with published retention periods.
Vulnerability reporting
Found something? Tell us.
Report suspected vulnerabilities to security@verinten.com. Include the affected URL or endpoint, the steps to reproduce, and what you observed. We acknowledge reports and will tell you what we found, whether or not the report is actionable.
Please do not access, modify, or exfiltrate data belonging to another workspace while testing, and do not run denial-of-service or automated bulk scanning against production. Reports made in good faith within those limits will not lead to legal action from us.
For a formal control summary suitable for a procurement review, see the Security Overview.