Security at Veribl
How we protect your team's access and your customers' data: single sign-on, two-factor, roles and an audit log of every change, encrypted connections, signed webhooks and a 99.9% uptime SLA.
Veribl | Security
Everything your security and procurement teams need to review Veribl: the controls in the product, how we handle data, and the documents we share on request.
Last verified
Quick summary
- SAML single sign-on, and you can require it
- SCIM user provisioning
- Two-factor, required for everyone if you want
- Custom roles from 23 permissions
- Audit log of every change, with before and after
- Encrypted in transit and at rest
- Export your data at any time
- Scoped API keys and signed webhooks
- 99.9% uptime SLA and a public status page
- 2-hour answer for urgent issues, any time
- EU company, GDPR processor with a DPA
- Your data never trains AI models
Controls8
Access and identityYour team signs in the way your company decides.
- SAML single sign-on with Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 provider.
- You prove you own your email domain with a DNS record before single sign-on turns on.
- Require single sign-on: everyone at your domain must use it, and passwords and Google sign-in stop working for them.
- SCIM user provisioning: your identity provider adds people to Veribl and removes them when they leave. The account owner is never removed automatically.
- New people who sign in through single sign-on get the role you choose, Member or Viewer.
- Two-factor sign-in with an authenticator app and 10 one-time recovery codes. Admins can require it for everyone in the company.
- After 5 wrong two-factor codes, sign-in locks for 15 minutes.
- Removing a teammate or changing a password ends their other sessions right away.
Roles and audit logEveryone can do exactly what their job needs, and every change is on record.
- Owner, Admin, Member and Viewer roles, plus custom roles you build from 23 permissions across products, Help Center, customers, helpdesk, warranties, commerce, branding, analytics and settings.
- Nobody can give someone more access than they have themselves, and the account owner can't be removed or demoted by others.
- The audit log records who made each change (a person, an API key, an app or the AI assistant), what changed, the value before and after, the IP address and the browser.
- Filter the audit log by area, product or person.
- Every change in the dashboard is permission-checked and recorded. Our build fails if a new feature skips either check.
- Changes the AI assistant suggests are only saved after someone on your team approves them.
Data protectionYour data is encrypted in transit, kept to your company, and yours to take.
- All traffic to the dashboard, product pages, passports and API is encrypted with TLS.
- Data at rest is encrypted by our database and hosting providers.
- Integration secrets and two-factor secrets are also encrypted by Veribl itself with AES-256-GCM before they are stored.
- Every request is limited to your own company's data, and product access is checked on each one.
- Export your customers, products and passports at any time, as files or through the API.
- Delete customers one by one or in bulk. Ask us and we delete your whole account.
API and integrationsConnections get only the access you give them, and you can take it back.
- API keys are scoped per area: no access, read, or read and write.
- Revoke a key at any time. Every change a key makes is in the audit log.
- Each key can make 120 requests a minute.
- Webhooks are signed with HMAC, so your systems can check each one came from Veribl. Failed deliveries are retried for 3 days.
- Apps connect through OAuth, and you can disconnect any app at any time.
Abuse protectionBots and runaway costs are stopped before they reach your account.
- Cloudflare Turnstile checks every email sign-up for bots, and disposable email addresses are blocked.
- Sign-ups are limited per IP address, per email domain and in total each hour.
- AI usage has a spending ceiling per workspace, so a flood of questions can't run up your bill.
- Rate limits protect the API and the AI chat.
Uptime and supportA public status page, a 99.9% uptime SLA, and a 2-hour answer when it's urgent.
- Live service status at support.veribl.com/status.
- A 99.9% monthly uptime SLA for product pages and passports, the dashboard and the API, with service credits if we miss it.
- Planned maintenance is announced 48 hours ahead.
- Priority support: a person answers urgent issues within 2 hours, any day and any time.
- Onboarding and training for your team are included, from the people who build Veribl.
Privacy and GDPRAn EU company, acting as your processor under a Data Processing Agreement.
- Veribl is an EU company, headquartered in Riga, Latvia.
- You are the controller of the customer data you collect through Veribl. Veribl processes it on your behalf.
- A Data Processing Agreement is available on request.
- Where a provider processes data outside the EU/EEA, Standard Contractual Clauses or the EU-U.S. Data Privacy Framework protect it.
- You decide what customer information to collect. Veribl records marketing consent and lets you export or delete customer data.
AI data handlingYour documents power the answers. They are not used to train AI models.
- Your product documents and help articles give the AI assistant the context for its answers.
- Chat messages and product context are processed by a third-party AI provider under a data processing agreement, and are not used to train its models.
- Each product page shows that answers come from an AI assistant.
- AI answers can be wrong or incomplete, so keep your documents current and give customers a way to reach a person. Handoffs to your team are built in.
The controls, as your admins see them.
Each one is a setting in the Veribl dashboard, not a promise in a contract.
Verify your domain, connect your identity provider, then require single sign-on so passwords and Google stop working for your team.
One switch makes every teammate sign in with a code from their phone, with recovery codes in case it gets lost.
Build a role from 23 permissions, so support agents can reply to tickets without touching products or exports.
See who changed what, the value before and after, and the IP address, whether it was a person, an API key or the AI assistant.
Security questions.
Plain answers to what security and procurement teams ask. Get in touch.