Trust Center
Banks, insurers and healthcare companies trust us with their customers’ identity and health data. Here’s how we protect it, and what auditors found.
Audits and reports
Outside firms test our security. Here’s what they found in our latest audits, and how to get the full reports.
An independent CPA firm tested how our security controls ran over a full year. It found no exceptions in any test, and the opinion is unqualified.
The same audit tested our safeguards against the HIPAA Security, Breach Notification and Privacy Rules, as they apply to business associates.
Astra Security tested our customer dashboard in its staging environment. We fixed the vulnerabilities they found and earned an A+ grade.
SOC 2 Type II report, BAA or penetration test certificate. Shared under NDA.
Data protection
Verified returns only the fields you request, and only with the person’s consent. We don’t keep identity or health data after returning it to you, apart from short-lived caches and logs.
Data is encrypted in transit over public networks and at rest in our databases.
We only look someone up after they agree to share their details with you.
You choose the fields your form needs. Nothing else comes back.
All production systems and customer data run on Amazon Web Services. We don’t run our own data centers.
Partners sign contracts with security requirements, plus BAAs for health data. We review high-risk vendors’ audit reports every year.
Production is backed up daily, and we test restoring from backup at least once a year.
Privacy
A company has to ask
Verified shares data only when a company requests it for a specific person.
People see who’s asking
Before we look anything up, the person sees which company is asking and what it wants.
Nothing happens without consent
We source a person’s information only after they agree, and they can always say no.
Security program
We run 132 controls across SOC 2 and HIPAA, with more than 200 automated tests that check them continuously. Our SOC 2 Type II audit checked how our controls actually ran from August 2025 to July 2026. Here’s what they cover.
Unique accounts and multi-factor authentication for our systems and tools. People get only the access their role needs, approved by the system owner, reviewed every quarter, and removed when they leave.
Encryption over public networks and at rest. Secrets and keys are handled under a written key management policy.
Code changes are tested and approved by an independent reviewer before they’re merged, and hotfixes are reviewed within a week. Development, staging and production are kept separate.
Infrastructure and code are scanned for vulnerabilities, cloud systems are patched regularly, and an outside firm tests us every year.
Logging and alerting flag threats and unusual activity, and security events are tracked to resolution. Our incident response plan is tested every year.
Daily backups, a yearly restore test, and a disaster recovery plan we rehearse every year.
Background checks and signed confidentiality agreements before day one, security training at hire and every year, and HIPAA training for anyone who can access health data.
Company devices are centrally managed, with disk encryption, antivirus and strong passwords enforced. Shared accounts are kept in a password manager.
A formal risk assessment every year, a security committee that meets every quarter, and yearly reviews of high-risk vendors.
Policies
Every policy is available to all employees and contractors and reviewed at least once a year. Customers can request copies under NDA.
Request documents
Tell us what you need and we’ll send it over. Reports and policies are shared under NDA.
FAQ
Yes. Request it above and we’ll share it under NDA. Our latest SOC 2 Type II report covers August 1, 2025 to July 31, 2026 and includes our HIPAA safeguards.
Yes. We sign a Business Associate Agreement with healthcare customers whose use of 1-Click Health makes us a business associate. We also have BAAs with the data partners that handle health data for us.
No. Identity and health data are returned to you and then deleted. Logs from those requests can include personal data and are kept for up to 90 days, encrypted and access-controlled.
In Amazon Web Services. AWS is the only subservice organization in our SOC 2 report, and its own SOC reports cover the physical security of its data centers.
AWS hosts our production systems, and data and messaging partners help us verify identities, phone numbers and insurance details. Our sub-processor list is on our Legal page.
We follow a written incident response plan, test it every year, and review every incident afterward. If an incident affects your data, we notify you, including any breach notice HIPAA requires.
Email security@verified.inc with what you found and how to reproduce it. We review every report and follow up with you.
A few things our SOC 2 report relies on, including managing your team’s access to Verified, telling us immediately about any suspected breach, and keeping a BAA with us where HIPAA requires one.
Yes. Verified carries cybersecurity insurance, and it’s one of the controls covered by our SOC 2 audit.
Try the live demo, customized for your company in about a second, or talk with our team about your signup flow.
Book a callEnter your work email and we’ll build you a custom demo in 1 second.
Open the live demo