Verdict Labs, Inc.
Security and Compliance Posture
Verdict processes pitch decks and the analysis derived from them, which places confidential deal material in scope. This page states the controls that are in place, the retention periods that apply, the third parties that receive data, and the controls Verdict does not have. It is a factual summary. The binding commitments are in the Data Processing Addendum.
Account isolation and access control
Accounts are managed by Clerk on production keys served from clerk.useverdict.io. Every request to a data route resolves the signed-in user on the server before any record is read or written, and every query is scoped to that user.
Row-level security is enabled on every table that holds customer data, and no policy admits an unauthenticated request: each requires either a service-role credential or an authenticated session, so an anonymous query returns no rows. Some policies grant scoped access to the signed-in database role. The application ships no browser-side database client, so in practice a browser does not query the database directly. Server-side access uses a service-role credential that is not subject to row-level security. Isolation between accounts is therefore enforced by the server scoping every query, with row-level security operating as a second layer behind it rather than as an independent guarantee. Verdict does not claim that row-level security would contain an application-layer scoping defect.
Verdict personnel holding an administrative account can open any account’s reports through the application, and can download the deck file uploaded with a report while that file is still held, which is how support and debugging requests are answered. Two people hold that access: Verdict’s founder, and one further person authorized to help operate the service. They hold several such accounts between them, because the founder signs in under more than one address. Access is not gated on a per-incident customer authorization, and opening a report leaves no record at all, so Verdict cannot tell a customer whether or when its reports were opened by Verdict personnel. A customer for whom that is unacceptable should raise it before uploading confidential material.
The service-role credential is held only in deployment environment secrets, is never committed to source control, and is separate from the secret used to sign internal job-trigger tokens.
| Data | Scope |
|---|---|
| Decks and memos | Owning account |
| Semantic search index | Owning account |
| Fund profile | Owning account |
| Per-account calibration | Owning account |
| Memo feedback | Owning account |
| Enriched fund profile | Owning account. The stored record is read only on the server, but investor suggestions derived from it are rendered in the account’s memo and are therefore visible to anyone the account shares that memo with. |
Encryption
Deck files in Supabase Storage are encrypted at rest with AES-256, and traffic to and from the application runs over TLS 1.2 or higher. Payment details are submitted directly to the payment processor through tokenized checkout, so full payment-card numbers do not reach Verdict infrastructure.
Retention
A deck is assigned a retention level at upload. Two levels exist. The level governs how long the source file is kept, and covers a financial model uploaded with the deck on the same terms; the generated memo follows the standard period in both cases. The selector appears on the upload form.
Standard
90 days
The default. The deck file, any financial model uploaded with it, and the memo are retained for 90 days from creation and are then removed by a scheduled job that runs every hour.
Sensitive
24 hours
The deck file is removed within 24 hours of upload, and a financial model uploaded with it is removed on the same 24 hours. The clock runs from the upload itself, and nothing afterwards moves it: re-running the analysis, resuming it, and opening the memo all leave the removal time where it was. It applies whether or not the analysis completed, so a failed or incomplete run has its files removed on the same 24 hours. Each file is reached on its own account, so a financial model is removed on this clock whether or not the deck it accompanied is still held. The job described under Standard takes sensitive uploads more than 23 hours old, so removal lands inside the 24 hours rather than at the edge of it. The memo itself is retained for the standard 90-day period. Uploading a deck again to start a new analysis stores a second copy with its own clock; where a restart of a failed run reuses the copy already held, that copy is removed only once every memo referring to it is due, which can hold it longer than 24 hours. To remove an upload at a fixed time regardless of the number of copies, delete each memo.
Corrections submitted through in-product feedback controls are retained on a different schedule, because they calibrate later analysis for the same account. That schedule, and the retention of billing records and backups, is set out in Data Processing Addendum section 4.
Deletion and data rights
A single memo and its source deck can be deleted from the report list in the dashboard at any time, and the deck file leaves Storage as part of the same operation. Closing an account revokes access to its data immediately, and the stored content is then deleted within thirty (30) days of the request. That deletion is carried out by a person at Verdict rather than by a scheduled job, and Verdict confirms it by reply when it is done. An account is closed by writing to legal@useverdict.io from the address on the account. Records the payment processor is required to keep for tax and accounting purposes are retained on its own schedule.
Memos export to PDF from the viewer, and that is the only export the product provides. Any other copy of account data is assembled by hand on request, in no committed format. The full statement of rights, including the provisions applicable under the GDPR and the CCPA, is in the Privacy Policy.
No training on customer data
Decks, generated memos, and submitted corrections are not used to train any foundation model. Verdict’s model provider, Anthropic, processes each request under commercial terms that prohibit training on customer data; inputs and outputs may be retained by Anthropic for up to 30 days for trust-and-safety review and are then deleted. Calibration from submitted corrections operates only within the account that submitted them and does not propagate to any other account.
Sub-processors
Verdict engages the providers below. The canonical list, with a link to each provider’s own privacy commitments, is maintained in the Privacy Policy.
| Provider | Function |
|---|---|
| Clerk | Authentication. Email address and OAuth tokens. |
| Supabase | Database and deck storage. Encrypted at rest (AES-256), TLS 1.2 or higher in transit, hosted on AWS us-east-1. |
| Stripe | Payments. Tokenized card details through Stripe Checkout; full card numbers do not reach Verdict. |
| Anthropic | Model inference. Decks and prompts are processed for the request and retained by Anthropic for up to 30 days for trust-and-safety review, then deleted. No training on customer data. |
| Voyage AI | Text embedding for account-scoped retrieval. Receives text derived from submitted documents and passages of the account’s own generated analysis. Does not receive the original files. |
| CloudConvert | Converts uploaded presentation and document files to PDF, then deletes them on its side. |
| Resend | Email delivery, outbound and inbound. Recipient address and message body for transactional messages, plus the stored subscriber audience for the newsletter. Where an account enables the forwarding address offered in its settings, also the mail sent to that address and any attached deck. |
| Slack | Delivery of analysis into a connected workspace, at the account’s direction. Applies only to accounts that have connected a workspace. |
| PostHog | Product analytics. Pageviews and feature usage, plus the account identifier, email address, and first name of a signed-in user. Browser capture is suppressed when the browser sends a Do Not Track header; some account events are recorded server-side and are not. |
| Google Analytics | Site analytics. Included on all pages, but not presently permitted to load by Verdict’s content security policy, so it is not at present receiving data. Where it executes it receives pageviews, device and browser metadata, and IP address. |
| Sentry | Error monitoring. Stack traces and request metadata. |
| Vercel | Hosting and serverless functions. Request logs. |
| Tavily | Web search for fund-partner research. Receives the partner names and links the account enters. |
| Cloudflare | Bot challenge on the sign-in and sign-up screens. Receives visitor IP address and challenge telemetry. |
| Google (Calendar) | Calendar event data, for accounts holding an existing Google authorization only. Not available to new users. |
How a memo run is recorded
Each memo run records structured evidence of how it was produced, so the output can be reviewed after the fact.
- Processing telemetry: cost, latency, cache utilization, and token counts for each stage of a run.
- Failure records: a structured record for any stage that fails or does not pass validation, surfaced in the report viewer so the run can be resumed.
- Lifecycle markers: gate decisions and the boundaries of model calls and database writes for post-analysis work.
- Self-audit findings: findings recorded at the end of a run and read by later runs on the same account to catch recurring errors.
Controls Verdict does not have
Verdict is an early-stage company. The following controls are not in place.
No third-party security certification
Verdict holds no SOC 2, ISO 27001, or equivalent attestation. No auditor has been engaged and no certification is scheduled. Verdict does not publish a target date for one. Internal practice is documented but unattested.
No third-party penetration test
No external penetration test has been performed against the Service and none is scheduled. Verdict relies on internal review and on the coordinated disclosure channel below.
No customer-managed encryption keys
Encryption keys are managed by Verdict’s infrastructure providers. Verdict does not offer per-customer or per-document key management, and the Sensitive retention level described above is the shortest deck-retention option available.
No contractual service level
Verdict publishes no uptime commitment, recovery time objective, or support response time. A reviewer who requires one should raise it before purchase.
No documented continuity or recovery plan
Verdict relies on the backup and recovery facilities of its infrastructure providers. It publishes no business continuity or disaster recovery plan, states no recovery point or recovery time objective, and has not carried out a documented restore test.
No customer-visible access log
A customer cannot presently retrieve a record of who opened its reports and when. This matters alongside the administrative access described above, and a reviewer who requires such a log should say so before purchase.
No enforced multi-factor authentication
Multi-factor authentication is available through the authentication provider but is not required of customer accounts. There is no single sign-on, no directory provisioning, and no role model within an account.
No formal security operations program
Verdict operates no security monitoring or alerting pipeline, runs no scheduled vulnerability scanning, and maintains no written incident response plan. Verdict has no employees, so background screening, access review, and offboarding procedures are not yet in place.
No data residency choice
All processing takes place in the United States. Verdict offers no regional hosting option.
A reviewer whose requirements are not met by the posture above is invited to state them in writing. Verdict will respond on whether it can meet them and on what timeline.
Reporting a security issue
Suspected vulnerabilities, suspected incidents, and security questionnaires should be sent to security@useverdict.io. Verdict aims to acknowledge a report within one business day. Where a confirmed incident affects an account’s data, Verdict notifies the address on that account within 72 hours of becoming aware of it, which is the timing required by Article 33 of the GDPR where that regulation applies.
A machine-readable security contact is published at /.well-known/security.txt in accordance with RFC 9116. Terms applicable to good-faith security research are in Terms of Service section 9.2.