Data and security

What this page is for

If you are filling in a prequalification questionnaire, or your client has asked where your compliance records are held, this page is written for you. It says what VeriKeep actually does, in enough detail to answer the question.

VeriKeep is not an accreditation body and holds no certification of its own. Nothing below is a claim to be certified; it is a description of how the product works.

Keeping one company's evidence away from another's

This is the failure we design against above all others, because a contractor whose evidence leaked to a competitor loses more than a document.

Separation is enforced in the database itself, not in the screens above it. Every row carries the company it belongs to, and the database refuses to return rows belonging to anyone else — whatever the application asks for. A mistake in a page cannot expose another company’s evidence, because the page is not what is doing the checking.

On top of that, which company you are looking at is part of the web address rather than a remembered setting, so two browser tabs cannot drift and show one company’s data under another’s name.

Where it is held

Documents are stored in the United Kingdom, in AWS London, and the application runs in London. Two supporting services process limited personal data in the European Economic Area — email delivery and error reporting — and neither receives your documents.

Every company involved is named on our sub-processors page. An auditor asking where your records are held needs a specific answer, and that page is it.

Who can see your files

• People you have invited to your company, at the level of access you gave them — view only, edit, or administer.
• Anyone holding a share link you created, for as long as that link is live. You make those deliberately and can revoke them.
• VeriKeep staff, only under the limits in the next section.

Files are never served from a public address. Each download is a short-lived link, generated for one person at the moment they ask for it, that stops working shortly afterwards.

What VeriKeep staff can reach

Our support staff cannot browse your evidence. To help with a problem they must request access, give a reason, and that request is written into your own activity log where you can read it. Access is read-only and expires.

Even then it stops short of the file. Support can see that a document exists, its name, size, type and version history — which is what actually resolves “my upload is not showing” — but opening the file itself is a separate, audited action rather than part of ordinary support.

The audit log

Significant actions are recorded: who uploaded, replaced, archived or removed a document, and when. This is the record you show an assessor.

It is append-only, enforced by the database rather than by our code. Entries cannot be edited or deleted — not by you, and not by us. An audit log the application can rewrite is not an audit log.

What happens to evidence

Evidence is never quietly destroyed while you are a customer. Documents are archived rather than deleted, and replacing a file keeps the version it replaced. Retention is your decision, not ours.

Two narrow exceptions exist, both restricted to administrators and both recorded in your audit log: removing a draft that has no file at all, and removing a file uploaded by mistake — which our staff can recover if it turns out to have been the wrong call.

If you close your account, everything is permanently destroyed 90 days later. We email at closure, at 30 days remaining and at 7, each time with a link to download all of it.

Accounts and sign-in

Sign-in, passwords and password resets are handled by our authentication provider rather than written by us — the failures in hand-rolled authentication are silent ones. Passwords are never stored in a readable form. Invitation and share links are stored only as a one-way fingerprint, so the links themselves cannot be recovered from our database.

Accessibility

VeriKeep is built to WCAG 2.2 Level AA. Our accessibility statement records what we have tested and any known limitations, and it is kept true rather than aspirational.

Reporting a security problem

If you believe you have found a security problem, please tell us at hello@verikeep.co.uk. Tell us what you found and how to reproduce it, and please give us a reasonable chance to fix it before publishing.

Last reviewed

This page was last reviewed in September 2026.