Trust Centre
Trust and security at Veritrail
A privacy product has to hold itself to a higher standard. Here is how Veritrail is built, what it stores, and what we are still working on — stated plainly, so you can tell what is in place today from what is on the way.
- Two-factor sign-in required for every user
- Hash-chained, tamper-evident audit log
- Row-level tenant isolation in Postgres
- Personal data encrypted and kept minimal
- HMAC-signed, outbound-only integrations
- Data hosted in India (AWS Mumbai)planned
- Independent penetration testplanned
- ISO 27001 and SOC 2 assuranceroadmap
In place today. Items marked planned or roadmap are not done yet.
What Veritrail holds, and how
| Consent records | Append-only. The person is a keyed HMAC token, not their identifier. |
|---|---|
| Identifier and contact email | AES-256-GCM encrypted, and kept only while a withdrawal, retention deletion or request is in progress. Then erased. |
| Rights request details | Encrypted per request. Responses are logged by SHA-256 fingerprint, not by their text. |
| Your customer records | Not held. Veritrail tells your systems what to do; the agent runs SQL inside your network. |
| IP addresses | Keyed hashes only. |
Controls
Tenant isolation
Postgres row-level security separates every organisation. The API connects as a role with no superuser or bypass rights, and each request runs scoped to one organisation.
Integrity
A hash-chained audit log written in the same transaction as each change. Audit events, consents and reports are append-only, and database triggers refuse edits.
Access control
Two-factor sign-in is required for every user. Sign-in attempts are rate-limited, and admin, officer and read-only auditor roles keep access narrow.
API keys
Random 192-bit keys, stored only as SHA-256 hashes and shown once. Website keys work only from allowed origins and require signed subject tokens.
Safe integrations
Webhooks are HMAC-signed, must use https and resolve to public addresses, and are pinned to the checked address. The database agent makes outbound connections only.
Secure development
Schema validation on every input, a strict Content Security Policy, and CI that runs dependency audits, secret scanning and end-to-end tests on every change.
What’s next
We would rather tell you what is planned than imply it is done.
- • Production hosting in AWS Mumbai (ap-south-1), so data stays in India.
- • Encryption keys moved to AWS KMS.
- • An independent penetration test before the first paid pilot.
- • ISO 27001 and SOC 2 assurance on our roadmap.
Report a vulnerability
If you think you have found a security issue, email support@datrovatech.com with “Security report” in the subject. Please don’t access other customers’ data or disrupt the service while testing. We will acknowledge your report and keep you updated.
Need our security pack for procurement?
We can share the full security overview and answer your questionnaire as part of a pilot.