Trust
AskVerum is a trust organisation. We hold ourselves to the same bar we help customers apply to AI-assisted decisions — transparent controls, honest status labels, and no certification claims we have not earned.
Every Monday, GitHub Actions runs our internal audit-readiness checks and publishes results here. This is operational transparency for founders and customers — not a SOC 2, ISO, or third-party certification report.
No public weekly compliance summary is published here yet. When runs are posted, they will appear on this panel. Until then, treat framework labels on this page as control posture, not as evidence of an issued SOC 2 or ISO certificate.
Defence in depth — six layers from perimeter access through governance monitoring. This is how we protect the platform and your investigation data.
Google OAuth and session security, row-level data isolation, separated admin and auditor roles, rate limits, and consent gates.
Harm-category hard blocks, prompt-injection detection, classifier adversarial scanning, and ingest rate limits on documents and links.
Domain-bound answering, independent multi-model investigation, tier enforcement, and no autonomous execution — investigations are read-only.
Synthesis harm checks, professional disclaimers (medical, legal, financial), and adversarial pattern flags before results are delivered.
TLS in transit, provider encryption at rest, audit logging, subprocessors disclosed in our Privacy Policy, and no training on your investigation content.
Automated regression (VAEL), red-team suites, calibration and drift monitoring, and threat-informed design (OWASP LLM, MITRE ATLAS).
Status labels we use internally and with enterprise buyers. Methodology for how we score answers lives on .
Controls aligned to Trust Services Criteria. Type I/II engagement with an accredited auditor is the next step — we do not yet hold a SOC 2 report.
AI management practices mapped to an Artificial Intelligence Management System (AIMS). Certification requires external audit — not yet issued.
ISMS scope and Statement of Applicability (SoA v1) documented. Certification follows SOC 2 Type I evidence collection.
Privacy policy, subprocessors, data-subject requests via grievance@, and no sale of personal data. Enterprise DPAs via counsel.
Govern, Map, Measure, and Manage — published mapping with evidence paths. Not a certification program.
Reviewed on each release; mitigations span injection, leakage, supply chain, and abuse.
AI adversarial threats mapped with automated regression suites (injection and pack fixtures).
We design against adversarial AI threats using the MITRE ATLASknowledge base (the AI counterpart to MITRE ATT&CK), including:
Red-team suites (prompt injection heuristics, API abuse guards, VAEL adversarial regression) run as part of our governance ritual. Residual risk is documented honestly — no security product eliminates all adversarial AI risk.
Full detail in our .
| Provider | Purpose |
|---|---|
| Supabase | Database, auth, storage |
| Vercel / Railway / Cloudflare | Hosting & CDN |
| OpenRouter + model hosts | AI inference (query processing only) |
| OAuth sign-in | |
| Razorpay | Payments (no query content) |
| Resend | Transactional email |
| MSG91 / Twilio | SMS (waitlist — with consent) |
| Plausible | Cookie-free aggregated analytics |
Security reports, privacy & data rights: grievance@ask-verum.com
Enterprise security questionnaires and methodology briefs: info@ask-verum.com (NDA available).
Last updated October 2026 · AskVerum Platform