Security at VeroID
VeroID handles identity verification data for Australian businesses. This page summarises how we protect it. Our Information Security Policy sets out the commitments our management has made.
Our approach
VeroID operates an information security management system (ISMS) aligned to ISO/IEC 27001:2022 and is working towards independent certification. Security controls are chosen from a documented risk assessment, reviewed by management at least annually, and audited independently.
Key controls
- Australian data residency for all verification and customer data.
- Encryption in transit (TLS 1.2+) and at rest.
- Multi-factor authentication for administrative access; scoped, revocable API keys for integrations.
- Least-privilege access with quarterly access reviews.
- Infrastructure as code, peer-reviewed changes, automated tests and dependency vulnerability scanning.
- Continuous monitoring and alerting with a public status page.
- Daily encrypted backups with tested recovery procedures.
- Documented incident response, business continuity and supplier management.
- Data minimisation: identity attributes are used for verification and are not retained beyond what the service requires.
Common questions
Where is data stored?
All verification records, customer accounts and screening data are stored in Amazon Web Services' Sydney region (ap-southeast-2), and our API runs in the same region. The website and customer dashboard are hosted on Vercel with serverless functions in the Sydney (syd1) region.
Is data encrypted?
Yes. All traffic uses TLS 1.2 or higher. Databases, object storage and queues are encrypted at rest with AWS-managed keys. Secrets are held in AWS Systems Manager Parameter Store or SST secrets, never in source code.
Who can access production?
A small number of named personnel. Administrative access requires a password plus a time-based one-time code (MFA). Customer dashboards sign in with Google OAuth. API access uses scoped API keys that are hashed in storage and can be rotated or revoked at any time.
How do you monitor for problems?
Infrastructure, error-rate, latency, queue depth and availability alarms route to on-call personnel 24/7. Administrative actions are written to an audit log. A public status page is available at veroid.com.au/status.
What about backups and recovery?
Databases are backed up automatically every day with point-in-time recovery. Infrastructure is defined as code and can be rebuilt from the repository. Our recovery time and recovery point objectives are 24 hours.
How are security incidents handled?
We maintain an incident response plan covering triage, containment, eradication, recovery and post-incident review. If an incident affects your data we will notify you without undue delay, and we meet our obligations under the Notifiable Data Breaches scheme of the Privacy Act 1988 (Cth).
How long do you keep verification data?
Verification outcomes and audit metadata are retained for the periods required by law and our government service agreements, and identity attributes are not stored beyond what verification requires. Details are in our Privacy Policy.
Sub-processors
The following third parties process data on our behalf. We assess each supplier before engagement and review them at least annually.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | API compute, database, storage, queues, monitoring | Sydney (ap-southeast-2) |
| Vercel | Hosting for the website, customer dashboard and documentation | Sydney (syd1) serverless region; global edge for static assets |
| Google Workspace | Business email and sign-in for customer accounts (Google OAuth) | Global |
| Revolut Business | Payments and hosted checkout | United Kingdom / EU |
| Resend | Transactional email (no identity data) | United States |
| OpenAI | Text generation for internal business tooling (no identity data) | United States |
| Zyte | Web fetching for public adverse-media sources (public URLs only) | Ireland |
Reporting a security concern
If you believe you have found a vulnerability in a VeroID service, or have a security question, email security@veroid.com.au. We acknowledge reports within two business days and will keep you informed while we investigate. Please do not access, modify or retain data that is not yours while testing.
Due diligence
Customers and prospective customers can request our detailed security documentation, including policies, risk treatment summary and supplier assurance records, under a non-disclosure agreement. Contact security@veroid.com.au.
One Shot Ventures Pty Ltd (ABN 50 690 149 609), trading as VeroID. See also our Privacy Policy and Terms of Service.