Data Protection
Last updated: November 8, 2026
This page describes the technical and organizational measures Verika Due Diligence Group ("Verika") uses to protect the confidentiality of engagement data — the same posture referenced in our Privacy Policy, in more operational detail.
1. NDA Before Access
Verika does not open a company's data room until a mutual NDA has been executed between Verika and the client fund. Access is granted only for the duration of the engagement.
2. Role-Based Access Control
Our platform enforces three account roles, and access is checked against the role attached to each account on every request — not just at login:
- Admin — full access to manage engagements, staff accounts, and client accounts.
- Reviewer — Verika staff assigned to engagements; can access the full working file for engagements they're assigned to.
- Client — fund personnel; can access only a curated status view of their own active engagements. Client accounts cannot read Verika's internal working files, reviewer notes, or another client's engagements under any circumstance — this is enforced at the infrastructure level, not just hidden in the interface.
3. Data Minimization for Clients
What a client fund sees through the Client Portal is deliberately a subset of our internal working file: workstream status rather than working notes, and findings only once a reviewer has written client-appropriate language for them. Raw call notes and internal risk annotations are never exposed to a client account.
4. Encryption
Data is encrypted in transit using TLS. Data at rest is encrypted by our infrastructure providers as described below.
5. Subprocessors
We use the following service providers to deliver the Services. Each processes data only as necessary to perform its function for Verika.
| Provider | Purpose | Data Involved |
|---|---|---|
| Google Firebase / Google Cloud | Application hosting, database, file storage, and account authentication | All engagement, account, and document data |
| Resend | Transactional email delivery (invites, notifications, report-ready alerts) | Recipient name and email, message content |
A current list of subprocessors is available on request at privacy@verika.org.
6. Data Retention and Deletion
Engagement data is retained as described in our Privacy Policy. A client fund or company under review may request deletion of specific records subject to our professional recordkeeping obligations.
7. Incident Response
In the event of a confirmed data breach affecting your data, we will notify affected client funds without undue delay, and will notify the relevant regulator where required by [APPLICABLE_DATA_PROTECTION_LAW].
8. Your Responsibilities
Client Portal accounts are issued to named individuals. You're responsible for keeping your credentials confidential and restricting Portal access to personnel within your organization who are authorized to see the relevant engagement.
9. Requesting More
A client fund or a company under review may request a copy of our security practices summary or a signed Data Processing Agreement by contacting privacy@verika.org.
10. Changes to This Page
We may update this page as our practices or providers change. Material changes will be reflected by an updated "Last updated" date above.