Privacy & Cookie Policy

This policy covers the Verix website, dashboard, command-line tool and the agent that runs against connected repositories. It explains what we collect, why we collect it, and how long we keep it.

It does not cover third-party services you connect Verix to. Your code host, identity provider and chat tool each have their own terms.

• Account data: name, work email address, organisation, and the identity provider you signed in with.
• Repository metadata: repository and branch names, commit identifiers, file paths, language and dependency manifests.
• Source code: the files an active detection or remediation run needs to read, held only for the duration of that run and its validation.
• Findings and fixes: detected issues, the evidence attached to them, proposed diffs and validation results.
• Product telemetry: pages viewed, features used, error reports and performance traces from our own systems.
• Billing data: plan, seat count and invoice history. Card details are held by our payment processor, never by us.

Source code is read to produce findings and fixes. Secrets, tokens and credentials are redacted from snippets and traces before any model call. Code is processed in an isolated sandbox that has no write path back to your infrastructure.

We do not use your source code to train foundation models. Enterprise agreements can add stricter residency terms, including running the control plane and the validation sandbox entirely inside your own environment.

• To provide the service: detect issues, understand them, propose fixes, validate those fixes and open pull requests.
• To secure the service: detect abuse, investigate incidents and keep an audit trail of privileged actions.
• To support you: answer tickets and reproduce the problems you report.
• To bill you: calculate seats and usage under your plan.
• To improve the product: aggregate usage patterns that never contain your source code.

• Source code fetched for a run is discarded once the run and its validation complete.
• Findings, diffs and validation results are kept for the life of the account, or until you delete the repository from Verix.
• Product telemetry is retained for 13 months in aggregate form.
• Billing records are retained as long as tax and accounting law requires.

Deleting an organisation removes findings, diffs and validation history within 30 days, backups included. Enterprise contracts can set shorter windows.

We do not sell personal data. We share it only with sub-processors that make the service work — cloud hosting, model inference, error monitoring, email delivery and payments — each under contract and limited to what their function requires.

The current sub-processor list is available on request, and enterprise customers are notified before a new one is added.

• Strictly necessary: session and authentication cookies. These cannot be turned off without breaking sign-in.
• Preferences: interface settings such as saved filters on the findings table.
• Analytics: aggregate product usage, used to decide what to build next.

We set no advertising cookies and run no cross-site tracking. You can clear or block cookies in your browser; strictly necessary cookies are required to stay signed in.

Data is encrypted in transit and at rest. Access to production is limited to on-call engineers, requires hardware-backed multi-factor authentication and is logged. Verix is SOC 2 Type II certified and ISO 27001 certified; reports are available under NDA.

Depending on where you live, you may request access to your personal data, correction, deletion, a portable copy, or restriction of processing. Write to the address below and we will respond within 30 days.

If your organisation administers your Verix account, we may route your request through your administrator.

Material changes are announced by email to account administrators at least 30 days before they take effect. The date at the top of this page always reflects the current version.