Controlled pilot posture

Trust starts with clear boundaries.

Verela is built for sensitive institutional workflows, but it does not claim certifications, regulatory approval, or production readiness that has not been independently earned.
Security model

Controls follow the data and the decision

Identity evidence receives the highest protection. Operational telemetry uses safe identifiers and allowlisted metadata only.
Six operating controls
  • Institution isolationWorkOS identity, server-resolved organization membership, role checks, and tenant-scoped data access on every sensitive request.
  • Evidence protectionPrivate checksummed uploads, encryption-capable object storage, progressive collection, and no raw evidence in application logs.
  • Credential boundariesHigh-entropy applicant links, hashed API keys, explicit scopes, short validity, revocation, and redaction from URLs and artifacts.
  • Reconstructable decisionsVersioned policy, normalized checks, actor history, request IDs, and immutable decision events preserve accountability.
  • Retention and recoveryConfigurable evidence deletion, legal-hold controls, separate metadata history, and production restore testing before activation.
  • Operational securitySeparate environments, bounded service access, encrypted backups, dependency scanning, secret scanning, and compiled-artifact inspection.

What remains gated

Production identity or credit data, a real verification provider, BIC/BRH connectivity, official registry claims, biometric or credit model use, and each additional country require named contracts, qualified legal review, institution approval, security sign-off, and jurisdiction-specific authorization.
Discuss pilot controlsView integration boundaries
Security documentation is reviewed with a prospective institution before any production-data decision.
Legal documents

Draft agreements pending legal review

The following legal documents are published as drafts pending qualified legal review. They are not binding agreements. Review them alongside this security model before any production-data decision.