Security & Compliance

Veritas Ask applies server-side identity and access checks, role and record permissions for organisation content, controlled document selection, selected audit metadata, and content export and deletion functions. The TOMs describe the scope and limitations of these controls. Customer Data is stored and processed in the EU, and Customer Content is not used to train Veritas Ask.

These statements describe functions and commitments. They do not assert an independently audited control environment, an immutable audit trail, zero supplier retention or an unverified encryption or recovery configuration. Institutional customers must assess the evidence for the intended deployment.

“Compliance” requires satisfaction of the applicable legal obligation in its actual scope. “Alignment” or “designed with reference to” describes a design approach and is not certification. “Certification” requires an applicable, current certificate from the competent body covering the relevant entity and service. These terms are not interchangeable.

This page does not claim ISO certification, a SOC 2 report, NIS2 certification, HIPAA approval, regulatory authorisation or a public-sector cloud-catalogue listing. No such status should be inferred from a product profile, governance template, EU residency statement or legal document. Any requested assurance must be supported by current evidence for the contracted scope.

Report a suspected vulnerability or security incident to contact@veritasask.com with the affected function, time and a concise description. Do not include passwords, private keys, full client files or patient records in the initial message. We will arrange an appropriate exchange for sensitive evidence. Do not access other customers’ data or disrupt the Service when reporting an issue.

The DPA requires personal-data breach notification without undue delay, assistance, updates and evidence preservation. A fixed response time or around-the-clock support applies only if contractually agreed. The Customer should maintain its own incident contact and supervisory notification process; its regulatory deadline does not replace our processor notification duty.

Before controlled deployment, review the processing specification, supplier chain, actual security measures, retention, incident process and exit route. A specific use in public administration, justice, healthcare or finance may require additional statutory conditions and contractual schedules. Internal approval by the institution does not constitute supplier certification or establish that all regulatory conditions are met.

The Enterprise Terms address procurement, statutory publication, sector addenda and regulator access. If a required measure or authorisation is not established, the affected use must remain outside the agreed scope until resolved. General professional research and a regulated decision-support deployment require separate assessments.