Privacy policy

What we store

Account

Your email address and the sign-in data Supabase Auth keeps for it. If you sign in with Google or GitHub, Supabase also receives your name and profile picture from that provider. Passwords are handled by Supabase Auth; Verfy never sees or stores them.

Organizations

The organizations you create or join, your role in them, and invitations sent by email address.

Devices

For each enrolled device: its name, platform and public key. Device tokens are stored only as SHA-256 hashes.

Receipts

The receipts your devices upload: which tool was called, by which agent, when, the verdict and the rules that fired. Arguments and results are stored as hashes unless a device is configured to include redacted arguments.

Verfy Registry

Only if a device runs verfy team registry report: the SHA-256 pins of the tool definitions it has locked and when each was first and last reported, for its organization. No server names, tool names or definitions. Other organizations see only how many organizations reported a pin, and only from 3 up. Owners and admins can delete them in the dashboard; a pin not reported for 180 days is deleted.

Audit log

Who changed what in an organization and when (policies, locks, members, devices, exports).

Waitlist

If you join the Verfy Cloud waitlist: your email address, and the company, team size and agents you chose to give. It is used only to tell you when Verfy Cloud opens, never sold or shared, and removed when you ask.

Notifications

If an owner or admin connects Slack or Telegram: the webhook URL or bot token, kept for the server only. Messages sent there name the device, server, tool and rules involved, never arguments, and go through Slack or Telegram under their own privacy terms.

Rate limiting

A salted hash of your IP address, kept briefly in counters that slow down repeated sign-in attempts and abuse. The IP address itself is not stored.

The Verfy CLI runs on your machine. It keeps its receipts and policy locally and sends nothing anywhere unless you enroll it in a team. An enrolled device uploads its receipts, which hold hashes of arguments and results salted with a secret that stays on your machine, rather than the arguments, on its own at most every five minutes; with verfy team auto-sync off it uploads only when you run verfy sync.

How we use it

To run the service: to sign you in, to show your organization its own policies, devices and receipts, and to protect the service from abuse. We do not sell data or show ads. Cookies are limited to the sign-in session, your theme choice and the organization you last opened.

We count visits to the public pages with Vercel Web Analytics. It sets no cookies and keeps no IP address. For each page view it records the page (without anything after a ?), the site you came from, your country, and your browser, system and device type; a returning visitor is recognized only by a hash that is discarded after 24 hours. The dashboard, invitation and sign-in pages are not counted.

Who processes it

Supabase hosts the database, authentication and file storage. Vercel hosts the web app and counts page views. If you choose to sign in with Google or GitHub, that provider confirms your identity. Each of them processes data under its own privacy terms.

What Verfy itself can see

Verfy's operator has a read-only page that lists every account (email, when it signed up and last signed in, whether two-factor sign-in is on, its organizations and roles), every organization (name, members, how many devices and receipts it has, when it last uploaded) and the waitlist. It does not show receipt contents, policies or notification settings. It opens only for the operator's own account after a second factor, and every view is recorded in a log that cannot be changed. As the operator of the service, Verfy can also read the database in Supabase. Both are used only to answer support requests, stop abuse and count how Verfy is used.

Access and deletion

Write to contact@verfy.dev from the address on your account to get a copy of your data or to have your account deleted. Receipts and audit entries are append-only records that belong to the organization they were made in; an organization owner can ask for the whole organization to be deleted.