Security and data handling
How Veriom reads your code, what it stores and for how long, how it encrypts and isolates your data, and which AI models see it.
This page is for the security reviewer who needs to approve Veriom. It describes how Veriom handles your code and data, based on how the product is built.
How Veriom reads your code
- Veriom reads GitHub repositories through its GitHub App, with a short-lived installation token. GitLab and Bitbucket use the access you approve or the read-only token you give. See Connect a repository.
- When it fetches code, Git hooks, submodules, and Git LFS files are turned off.
- Scanners run in Veriom's runner. Each job gets its own temporary directory, readable only by the runner, which is deleted when the job ends.
- Veriom never merges into your repository. Fix pull requests open as drafts, and a person merges them.
What Veriom stores, and for how long
| Data | How it is stored | Kept for |
|---|---|---|
| Source snapshot of each audit | Encrypted with your workspace's key | 30 days |
| Archive the scanners read | Encrypted at rest | 3 hours |
| Raw scanner output | Encrypted with a key derived for that audit | 30 days |
| Uploaded ZIP files | Object storage, under your workspace's folder | 30 days |
| Findings and evidence excerpts | Database, isolated per workspace. Each excerpt is at most 1,000 characters. Secrets that secret detection finds are stored as [REDACTED] | Until resolved findings pass your plan's retention period |
| Activity log | Database, append-only, with sensitive values redacted | Your plan's retention period |
Retention periods by plan are in Plans and billing. An Admin can shorten them. See Export or delete workspace data.
Encryption and isolation
- Each workspace has its own data key. Veriom encrypts that key with a separate master key.
- Connector credentials and your own AI model keys are encrypted with AES-GCM and bound to your workspace. They are never shown again after you save them.
- Database access runs under Postgres row-level security keyed to your workspace, so one workspace's queries cannot read another's rows. An automated check tests these rules.
Where your data is
- Veriom's API, database, and scanner runner run in Render's Frankfurt region.
- Stored files, such as source snapshots and uploads, are in Cloudflare R2.
Which AI models see your data
Veriom's agents send a language model the bounded context assembled for each audit, plus the code snippets they search for.
- By default, Veriom's agents run through LLMGateway on Veriom's own account.
- You can run them on your own LLMGateway, OpenAI, Anthropic, or OpenRouter key instead. OpenAI calls are sent with storage turned off. OpenRouter calls are sent with data collection denied. See Use your own model keys.
- Veriom can replay redacted audit inputs on cheaper model settings to tune cost only if your workspace opts in.
Who can do what
- Five workspace roles limit what each person can see and change. See Members and roles.
- Sensitive changes need the person to confirm their identity again. The confirmation lasts 10 minutes.
- Members can use passwords, passkeys, and two-factor codes. Enterprise workspaces can use SAML or OIDC single sign-on and SCIM. See Single sign-on and SCIM.
- The access policy can limit networks, sign idle members out, and require two-factor sign-in.
- API tokens act within their creator's role and expire within 366 days. See API tokens.
Audit trail
The activity log records every change in the workspace. Entries cannot be edited. Growth and Enterprise workspaces can stream it to a SIEM.
Deletion
- An Owner can schedule a workspace's deletion. After a 7-day grace period, Veriom deletes its database records, stored files, and connector state.
- To erase a personal account, contact Veriom support.
Contracts
Veriom's Data Processing Agreement covers personal data. The list of subprocessors comes with your agreement.
Was this guide useful?
Your response stays in this browser unless you open a GitHub issue.Export or delete workspace data
Download a copy of a Veriom workspace's data, set how long Veriom keeps it, and schedule or cancel the workspace's deletion.
Troubleshooting
Look up a Veriom error code and fix it. Covers sign-in, tokens, plans and billing, connectors, repositories, CI, cloud connections, audits, and MCP.