Last updated: August 23, 2026

Security & Trust

VertData powers financial-intelligence workflows for B2B customers. Security isn't a section on a page for us — it's how we architect the platform. This page documents the controls, sub-processors, and practices we rely on.

1. Data protection

Encryption

• In transit: TLS 1.3 on all customer-facing endpoints. HSTS enforced. Weak ciphers disabled.
• At rest: AES-256 on all customer data, backups, and application logs. Keys are managed by our infrastructure provider's KMS.
• Between services: Internal service-to-service traffic runs on private networks; sensitive payloads are re-encrypted at the application layer.

Access control

• Least-privilege access. Production database access is limited to on-call engineers and gated by MFA.
• Customer accounts use bcrypt-hashed passwords, session tokens rotated on suspicious activity, and rate-limited authentication.
• API keys are scoped, revocable, and never returned in log output.

2. Infrastructure

VertData runs on hardened Linux servers in a US-based data center with 24/7 physical security, redundant power, and DDoS mitigation at the edge. Application backends are proxied behind Nginx with strict security headers (CSP, X-Frame-Options, Referrer-Policy).

Database backups run daily, are encrypted at rest, and are retained per our retention policy. Point-in-time recovery is available for the most recent 7 days of production data.

3. Sub-processors

We use a small set of vetted sub-processors to operate the platform. Each has signed a Data Processing Agreement (DPA) with us and is bound to equivalent security and privacy obligations.

Sub-processor	Purpose	Region
Supabase	Managed Postgres, authentication, row-level security	US (us-west-2)
Stripe	Payment processing, subscription billing	US / global
Resend	Transactional email delivery	US
Anthropic	AI-scored insight generation on non-personal record data	US
Cloudflare	DNS, edge protection, DDoS mitigation (where enabled)	Global
Google Analytics	Aggregated, anonymized website analytics	US
Hostinger	Underlying VPS infrastructure	US

We give customers advance notice of material changes to this list via the Privacy Policy revision log. If you're a customer with contractual notification requirements, email security@vertdata.com to be added to the sub-processor notification list.

4. Monitoring & incident response

• Application and infrastructure logs are centralized and retained for at least 90 days.
• Automated alerts fire on anomalous authentication, error rates, and unauthorized-access attempts.
• Suspected incidents are triaged within 24 hours. Confirmed breaches affecting customer data are disclosed to affected customers within 72 hours, in line with GDPR Article 33 and applicable state breach-notification laws.
• We maintain a documented incident-response runbook covering identification, containment, eradication, recovery, and post-mortem review.

5. Data minimization

VertData's core dataset is drawn from publicly available business, property, and professional records. We collect the minimum amount of customer account information needed to operate the service (email, hashed password, billing details processed by Stripe, and usage metadata). We don't sell contact data to third parties for marketing purposes unrelated to VertData's services.

6. Compliance program

• GDPR: We honor data-subject requests (access, rectification, erasure, portability, objection) received at privacy@vertdata.com within 30 days.
• CCPA / CPRA: California residents have the right to know, delete, correct, and opt out of the sale/sharing of personal information. We do not "sell" personal information as defined by CCPA.
• CAN-SPAM: All commercial email includes a functional unsubscribe link and physical postal address.
• DPA: Customers processing personal data through VertData can sign our standard Data Processing Agreement.

7. Responsible disclosure

If you believe you've found a security vulnerability, please email security@vertdata.com with:

• A clear description of the issue and affected endpoint(s)
• Steps to reproduce (proof-of-concept welcome, but no destructive testing)
• Your preferred contact for follow-up

We commit to acknowledging valid reports within 3 business days and won't pursue legal action against good-faith researchers who follow this policy.

8. Data ownership

You own your data. Customer-uploaded data, saved lists, notes, and workspace configuration are your property. VertData's role is a processor acting on your instructions. See Terms §7 and the DPA for the full commercial terms.