Our commitment
VerifyCore is built for regulated finance. Security, data integrity, and auditability are core product requirements — not afterthoughts. This page summarises how AMT Consulting LLC protects customer and end-user data across the platform.
Infrastructure
VerifyCore runs on Supabase with database and storage deployed in EU regions where configured for production tenants. Application services use isolated environments, encrypted backups, and monitored uptime targets aligned with our SLA commitments.
Encryption
- In transit — all client and API traffic is protected with TLS 1.2+ (TLS 1.3 preferred).
- At rest — database and object storage use AES-256 encryption; sensitive credentials and API key material are hashed or stored in secure environment configuration.
Access control
Platform access is governed by role-based permissions, organisation-scoped data isolation, and Supabase Row Level Security (RLS) policies. Administrative actions require authenticated sessions; service-role access is restricted to server-side operations with explicit tenant filters.
Enterprise SSO (SAML/OIDC) and cross-organization identity reuse are not available yet — contact support if your organization needs either.
Audit logging
Verification events, configuration changes, and reviewer decisions are recorded in an immutable audit trail designed for regulatory examination and internal compliance reviews. Export capabilities support periodic auditor requests.
Certifications
Formal certification programmes are in progress. VerifyCore is working toward SOC 2 Type II and ISO 27001 alignment. We will publish attestation status on this page as programmes complete.
Penetration testing
Independent penetration testing is planned for Q3 2026. Findings will be remediated according to severity and tracked through our internal security review process.
Responsible disclosure
If you believe you have discovered a security vulnerability, please report it responsibly to info@amt-ks.com. Include steps to reproduce, affected components, and any proof-of-concept material. We aim to acknowledge reports within five business days.
Bug bounty
A formal bug bounty programme is coming soon. Until launch, we appreciate coordinated disclosure and will recognise researchers who help improve platform security.