Security and data handling
Understand the controls behind your screening records.
Review the platform’s hosting and access model, then assess the external services used by your chosen workflow. Use this summary to scope a security review with your team.
- HTTPS
- Encrypted transport for the public application and API.
- Account-scoped results
- Authenticated access to saved results and API records.
- Scoped API keys
- Permissions separate reading results from creating paid checks.
Controls and their boundaries.
| Area | Implemented approach | Boundary |
|---|---|---|
| Hosting | Application and primary database on European Hetzner infrastructure. | External service processing is assessed separately. |
| API access | API keys, permissions and rate limits; account-scoped result retrieval. | Keep keys in server-side secrets and rotate them when access changes. |
| Payments | Stripe handles checkout and payment processing. | Billing information is subject to payment-provider terms. |
| Retention | Name-screening record deletion and configurable age-based retention. | Backups have a separate schedule; crypto records have separate scope. |
| Screening evidence | Saved findings, source links and name-screening PDF exports. | This is not a claim of tamper-proof storage or independent audit certification. |
AI and research have an external data flow.
OpenRouter routes AI work to model providers. Exa supplies live research search results. Names, context, candidate records and retrieved evidence can be processed by those services depending on the workflow.
We do not make a blanket claim of zero retention or EU-only processing by all providers. Ask about the current provider chain and applicable terms if your programme has restrictions on processing locations or model services.
Ask for evidence relevant to your programme.
Send your questionnaire and intended workflows to support. If you require an independent certification, audit report, penetration-test report, a particular backup policy or a contractual service level, request the specific evidence and terms before relying on them.
This summary does not claim ISO 27001 or SOC 2 certification. Contractual commitments come from the written terms agreed with your organisation.
Questions, answered.
Are screening records kept forever?
Account settings support deletion of name-screening records after 1, 5, 7 or 10 years, as well as manual deletion. Automatic deletion can be disabled. Backups have a separate retention schedule. Crypto address records do not currently have their own automatic retention setting.
Where should I report a vulnerability?
Contact support@screenveritai.com with Security in the subject and a minimal, sanitised description. Do not send passwords, API keys or another customer’s records.
Send security requirements
Choose the workflow and terms that fit your organisation.