Privacy policy

Who we are

VeriKeep is a service that helps UK contractors keep the documents their accreditations depend on in one place. This policy explains what personal data we hold, why we hold it and what you can ask us to do about it.

You can contact us about anything on this page at hello@verikeep.co.uk.

The most important thing on this page

There are two different kinds of information involved in VeriKeep, and your rights are different for each.

The documents your company uploads belong to your company. Your employer decides what goes in, how long it stays and who can see it. We only hold it and do what your employer asks. In the language of the law, your employer is the controller and we are the processor.

Our own records — that you have an account, the email address you signed up with, an email you sent us — are ours, and for those we are the controller. The rest of this page is mostly about those.

If you are an employee and you want a document about you removed, ask your employer, not us. They control it, and we will help them do it.

What we hold, and why

As the controller of our own records, we hold:

• Your email address and password, so that you can sign in. Passwords are never stored in a readable form.
• Your name and job title, if you chose to give them, so colleagues can tell who is who.
• Which company you belong to and what you are allowed to do there.
• A record of significant actions taken in your account — who uploaded, changed or removed a document, and when. This is the audit log your assessors may ask to see.
• Anything you write to us when you ask for help.
• Technical error reports when something goes wrong, so that we can fix it.

We do this because we have a contract with your company to provide the service, and because we have a legitimate interest in keeping the service secure, working and supportable.

What we do not do

We do not sell your data. We do not share it with advertisers. We do not use it to train anything. We do not track you across other websites — see our cookie policy, which is short because there is very little to say.

We do not read the documents you upload except where you ask us to help with a problem, and even then our staff access is limited, has to be justified, and is recorded in your own audit log where you can see it.

Where your data is

The documents you upload are stored in the United Kingdom, in AWS London, and the application that reads them runs in London too.

Two of the services we rely on process limited personal data in the European Economic Area: the service that sends our email, and the service that records technical errors. Neither receives your uploaded documents. We do not transfer your data outside the UK or EEA for any other purpose.

Every company involved is named on our sub-processors page, with what each one does.

How long we keep it

While your company is a customer, we keep your evidence for as long as they want it kept. That is deliberate: a contractor may need to show a certificate from years ago, and it is not our decision to throw it away.

When a company closes its account, everything is permanently destroyed 90 days later — the records and the files themselves. We email at closure, again with 30 days remaining and again with 7, each time with a link to download everything. If you would rather it went immediately, you can ask and we will do that instead.

The 90 days exist because compliance evidence is unusually hard to replace. An account can close because of a billing dispute or because the person who managed it left, and neither is a decision to destroy nine years of certificates.

Your rights

For the records we control, you can ask us to give you a copy, correct something wrong, delete it, or restrict what we do with it. You can also object to us relying on legitimate interests.

Write to hello@verikeep.co.uk and we will respond within one month.

For anything inside your company’s evidence, the request goes to your employer, because it is theirs. If they ask us to help, we will.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk. We would rather you told us first, but you do not have to.

Keeping it safe

Every company’s evidence is separated from every other company’s in the database itself, not merely in the screens above it. Files are served through short-lived links rather than public addresses. Significant actions are written to an audit log that the application cannot alter afterwards.

There is more detail on our data and security page, which is written for the person filling in a procurement questionnaire.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email before it takes effect rather than quietly editing this page.

Last reviewed

This policy was last reviewed in September 2026.