Your team's data stays your team's.
A plain account of what is actually true in Verayn today, backed by an internal security audit rather than marketing language.
Connectors, documents, conversations, and approvals are access-isolated per team at the database level. We tested this directly: a member of one team cannot read another team's data, even with a hand-crafted query.
RLS · verifiedAny action an AI would take for you, such as sending, creating, or changing something in a connected tool, stops and waits for a person to approve it. This is enforced by how the system is built, not a policy we promise to follow.
structural approvalOAuth tokens for the tools you connect are encrypted at rest with AES-256-GCM. They are never exposed to any browser, not even to the team that owns them.
AES-256-GCMWhen you connect a tool by URL, requests to internal and private addresses are blocked, so a connector cannot be pointed at internal systems.
SSRF-guardedFiles are type-checked and size-bounded on the server, stored in private storage with download links that expire in 60 seconds, and archives are guarded against decompression-bomb attacks.
validatedRate limiting on sensitive endpoints, plus browser security headers: HSTS, clickjacking protection, and content-type enforcement.
hardenedAn AI cannot take an action on your behalf without a person.
This is not a setting that can be turned off by accident, and not a rule we are trusting the AI to follow. Read actions happen freely. Anything that writes, sends, or changes something waits for a human.
Verayn is an early-access product built by a small team. We do not yet hold formal certifications such as SOC 2 or ISO 27001, and we will not claim we do. Everything on this page is what is actually true in the product today, verified by an internal audit. As we grow, we will pursue formal compliance and update this page honestly.