VerifyMesh

Security

Our actual posture, stated plainly. SaaS-appropriate, no theater.

  • API access requires a Bearer key; vendor webhooks are HMAC-SHA256 verified per request.
  • PII redaction is applied to all logs and timelines — document numbers, names, DOBs, and biometric fields become [REDACTED].
  • Raw identity data is never persisted: document payloads pass through adapters in memory only.
  • All secrets (API key, webhook secret) are environment-configured; structured logs never include them.
  • Failover decisions are driven by measured per-vendor health, not manual toggles.
  • Report a vulnerability: email us and we'll respond within 2 business days.
What we don't claim: we don't claim certifications we don't hold, we don't claim "military-grade" anything, and we don't claim a system can't fail — we claim the specific controls above and a 2-business-day response on reports.