← Back to Verayn
Security

Your team's data stays your team's.

A plain account of what is actually true in Verayn today, backed by an internal security audit rather than marketing language.

Last reviewed August 2026
The guarantees
Your team's data is isolated.

Connectors, documents, conversations, and approvals are access-isolated per team at the database level. We tested this directly: a member of one team cannot read another team's data, even with a hand-crafted query.

RLS · verified
AI can't act without a human.

Any action an AI would take for you, such as sending, creating, or changing something in a connected tool, stops and waits for a person to approve it. This is enforced by how the system is built, not a policy we promise to follow.

structural approval
Connector credentials are encrypted.

OAuth tokens for the tools you connect are encrypted at rest with AES-256-GCM. They are never exposed to any browser, not even to the team that owns them.

AES-256-GCM
Integrations can't reach your network.

When you connect a tool by URL, requests to internal and private addresses are blocked, so a connector cannot be pointed at internal systems.

SSRF-guarded
Uploads are handled safely.

Files are type-checked and size-bounded on the server, stored in private storage with download links that expire in 60 seconds, and archives are guarded against decompression-bomb attacks.

validated
Abuse protection is in place.

Rate limiting on sensitive endpoints, plus browser security headers: HSTS, clickjacking protection, and content-type enforcement.

hardened
How AI approval works

An AI cannot take an action on your behalf without a person.

01
The AI proposes an action.
02
It is held, and never executed on its own.
03
You or a teammate reviews and approves it. You cannot approve your own action.
04
Only then does it run.

This is not a setting that can be turned off by accident, and not a rule we are trusting the AI to follow. Read actions happen freely. Anything that writes, sends, or changes something waits for a human.

What we don't claim

Verayn is an early-access product built by a small team. We do not yet hold formal certifications such as SOC 2 or ISO 27001, and we will not claim we do. Everything on this page is what is actually true in the product today, verified by an internal audit. As we grow, we will pursue formal compliance and update this page honestly.

Have a security question, or something to report?security@verayn.appPrivacy Policy