Data loss prevention

What this covers

Customer data: order details, customers' names and email addresses, and the recordings and photos taken during a verification. Merchant secrets: the keys Verilo holds for a merchant's Shopify, Gorgias and Zendesk accounts.

Where the data is, and nowhere else

• The database: Neon Postgres in AWS us-east-2 (Ohio, United States). Orders, claims, results, the audit log.
• Recordings and photos: one Cloudflare R2 bucket in R2's United States jurisdiction. Every object is read through the Verilo app, which checks the merchant first.
• The app: Fly.io, region iad (Ashburn, United States). It keeps no customer data on disk; there are no Fly volumes.
• Live chat: messages written in the chat on verilo.app or in the dashboard are held by Crisp in the European Union.
• Email: Verification Links, reminders, team invites and notifications are sent through Resend (United States). Verilo keeps no copy of the message text.
• Helpdesk messages go to the merchant's own Gorgias or Zendesk. The full list of service providers is in the Privacy Policy.
• The founder's laptop holds only development test data, never production data.

Encryption

• In transit: HTTPS for every page and API; TLS to Neon (sslmode=require) and to R2.
• At rest: Neon and Cloudflare R2 encrypt all stored data (AES-256).
• Merchant secrets are encrypted again by Verilo (AES-256-GCM) with a key that exists only in Fly's secret store.

Who can reach it

• One person, the founder, holds the accounts that reach production: the Fly.io organisation (one member), the Neon project, the Cloudflare account and the Shopify Partner organisation.
• Inside the app, each merchant sees only its own data; every request is checked against the merchant it belongs to. Verification links are signed and expire after 72 hours.
• Opening a claim, downloading an evidence pack and exporting claims are written to the audit log, which cannot be edited.

Keeping it from leaking

• Logs record identifiers (claim, session and store IDs), never recordings, photos, message text or tokens.
• Detailed diagnostic logging runs only in development.
• Secrets live only in Fly's secret store, never in source code or the repository.
• Operational scripts run inside the production machine and print no secrets.

Backups and recovery

• The database: Neon's point-in-time restore, within the history window of Verilo's Neon plan.
• Recordings and photos have no second copy. This is deliberate: they are deleted after the merchant's retention period anyway. If they were lost, each Result and each recording's SHA-256 fingerprint would remain in the database.

How long data is kept

• Recordings and photos: deleted automatically 90 days after capture, or after the longer period the merchant sets (180 or 365 days).
• Customers' names and email addresses: deleted 90 days after the customer's latest order if no claim was made, and 12 months after it otherwise.
• Website sign-up requests: deleted after 12 months.
• When a store uninstalls Verilo, its data is deleted 48 hours later (Shopify's shop/redact). A customer's data is deleted when Shopify sends customers/redact.

Checked by hand (record the date when done)

• Two-factor sign-in on Fly.io, Neon, Cloudflare, Shopify Partners and Google Workspace.
• R2 bucket public access: Not allowed (Cloudflare → R2 → the bucket → Settings).
• Neon history retention (point-in-time restore window): Neon console → Settings → Storage.

Verilo (ABN 15 979 331 090) · hello@verilo.app