Controlled pilot posture
Verela is built for sensitive institutional workflows, but it does not claim certifications, regulatory approval, or production readiness that has not been independently earned.Trust starts with clear boundaries.
Current release posture
- EnvironmentSynthetic sandbox
- Production identity dataNone
- Live evidenceBlocked pending approvals
- Registry connectivityNot authorized
Security model
Identity evidence receives the highest protection. Operational telemetry uses safe identifiers and allowlisted metadata only.Controls follow the data and the decision
Institution isolation
WorkOS identity, server-resolved organization membership, role checks, and tenant-scoped data access on every sensitive request.Evidence protection
Private checksummed uploads, encryption-capable object storage, progressive collection, and no raw evidence in application logs.Credential boundaries
High-entropy applicant links, hashed API keys, explicit scopes, short validity, revocation, and redaction from URLs and artifacts.Reconstructable decisions
Versioned policy, normalized checks, actor history, request IDs, and immutable decision events preserve accountability.Retention and recovery
Configurable evidence deletion, legal-hold controls, separate metadata history, and production restore testing before activation.Operational security
Separate environments, bounded service access, encrypted backups, dependency scanning, secret scanning, and compiled-artifact inspection.What remains gated
Production identity or credit data, a real verification provider, BIC/BRH connectivity, official registry claims, biometric or credit model use, and each additional country require named contracts, qualified legal review, institution approval, security sign-off, and jurisdiction-specific authorization.Security documentation is reviewed with a prospective institution before any production-data decision.
Legal documents
The following legal documents are published as drafts pending qualified legal review. They are not binding agreements. Review them alongside this security model before any production-data decision.These documents are published in English only. Translated versions require the same qualified legal review as the originals.