Security

Verifex handles regulated screening data. This page states our controls plainly and separates what is implemented today from what is a contractual commitment and what is planned. Verifex is operated by ALKITAB LLC, a company registered in the Republic of Azerbaijan. Security questions can be sent to hello@verifex.dev.

Implemented

Controls that are in place today:

• HTTPS with TLS 1.3 for all API and web traffic
• HSTS enabled with a one-year max-age
• Passwords hashed with bcrypt (12 rounds)
• API keys stored as SHA-256 hashes (never in plaintext)
• HMAC-SHA256 signatures on webhook payloads
• SSRF and path-traversal protection on outbound and file operations
• Content-Security-Policy, X-Frame-Options: DENY, and X-Content-Type-Options: nosniff headers
• Zod input validation on API endpoints
• CSV-injection prevention on data exports
• Per-key and per-IP rate limiting
• Fail-closed design (requests are rejected when a security dependency is unavailable)
• Append-oriented audit logging — screening events recorded with source-list and algorithm versions
• Source-governance controls on ingested screening data
• CI secret scanning and dependency checks
• Automated regression and security tests
• Optional error tracking (Sentry) and operational alerting
• A documented incident-response process
• A responsible-disclosure channel

Contractual

Commitments made through agreements with customers:

• A Data Processing Agreement (DPA) available for contractual review
• A commitment to put EU Standard Contractual Clauses (SCCs) in place for international transfers where required (under legal review; not all executed yet)
• 30 days' notice of new subprocessors where contractually required

See our current providers at /subprocessors.

Planned

Improvements we are working toward but have not completed:

• Two-factor authentication for dashboard users
• Formal role-based access control (production access is currently limited to the founder)
• Full-disk encryption at rest
• Off-site backup improvements
• An independent penetration test
• A SOC 2 examination

Certifications & assurances

We describe our posture honestly. As of the last-updated date above:

• Verifex is not ISO 27001 certified.
• Verifex has not completed a SOC 2 examination.
• Verifex makes no formal GDPR certification claim.
• Verifex has not completed an independent penetration test.

Uptime

We target 99.9% uptime for the screening API. This is a target, not a formal SLA. There is no public SLA unless one is contractually agreed. Live status is available at status.verifex.dev.

Responsible disclosure

Found a vulnerability? Please report it under our responsible-disclosure policy or email hello@verifex.dev.