How VeraStream earns the trust of an AP, procurement, and SOX review.
The data envelope, the access controls, and the observability that wrap every VeraStream detector run — written for the reviewer who has to sign off on a vendor before AP spend ever reaches our pipeline. Pair this page with /security for the standing sub-processor disclosure.
Data handling
Encrypted in transit, encrypted at rest, scoped on access.
VeraStream runs against the AP transaction rows you choose to share. The default envelope is narrow: enough signal for the detectors to be useful, no PII beyond vendor name unless you ship it.
Encryption in transit
All browser-to-edge and edge-to-service traffic uses TLS 1.2 or higher. The edge enforces HSTS, so a downgrade attempt is rejected before any application data is read.
Encryption at rest
Render-managed Postgres and object storage both encrypt data at rest with AES-256. Uploaded audit files are access-scoped by signed per-report download tokens issued by /api/audit/download/[id].
Data residency
US by default (Render Oregon region); EU on contractual request for enterprise plans. Region is a contractual lever, not a runtime toggle — picked at contract time and provisioned before first ledger row lands.
Retention & deletion
90-day default for uploaded CSVs and in-progress run reports; fully customer-configurable per tenant. Customer-managed deletion is in the tenant console; written request to the POC triggers full deletion confirmed in writing within 30 days.
Access controls
Least privilege, audited RBAC, no prod data in dev.
Every read of a report artifact means holding a token tied to that single report and that single recipient. Roles are administered through the better-auth admin plugin so each assignment is logged.
Least privilege
Read-only roles for support, write only on the auditor-facing endpoints, no broad data-export role for any team. Role assignments and revocations are auditable.
RBAC via better-auth admin
Access tiers tie into the better-auth admin plugin, so reviewer, controller, and auditor roles are administered in one place and logged on every change.
No prod data in dev
Production data is never present in dev or staging. Internal testers run against fully synthetic or fully anonymised slices — never against real customer ledgers.
Audit & observability
Eight detectors, signed share tokens, in-browser PDF export.
Every audit run is wrapped in the same envelope: a detector pipeline your reviewer can name, a share path that tokens every artifact, and a PDF export that never re-lodges the report on our disk.
Eight-detector pipeline
Every audit run executes VeraStream's eight production detectors — duplicates, off-policy, split invoices, round-number flags, vendor master anomalies, weekend / holiday posting, duplicate vendor records, and ghost employees. The same detectors ship to /audit and to every customer.
Signed audit-share tokens
External report sharing is gated by a signed, single-purpose token bound to one report ID and one recipient; tokens expire and cannot be reused across reports or across recipients.
In-browser PDF generation
Customers export audit-run PDFs in-browser via the /audit PDF route. The PDF is generated client-side; the same audit report never lands on our disk twice.
SOC 2 Type II
SOC 2 Type II — in observation
We do not claim certifications we have not yet earned. The badge below names the status honestly, and the artifact slot is reserved for the owner-supplied report.
VeraStream is in observation for SOC 2 Type II. The observation window begins after SOC 2 Type I completes; the artifact itself — the audit report delivered by the assessor — is owner-supplied. Until that artifact is linked here, the section deliberately reads Pending. The page will be updated, and the DPA exhibit updated in lockstep, the moment the report lands. Until then this slot is reserved for the certificate document and the executive summary it ships with.
Frequently asked
Questions from controllers, CAEs, and procurement
What the data envelope covers, where SOC 2 Type II stands, and how audit runs are shared externally. Open what you need — the same string powers the FAQPage JSON-LD below so they can't drift.
›How is /trust different from /security?
/security is the standing sub-processor and encryption disclosure — Render, Postmark, Stripe, and the controls already operating in production. /trust is the posture page for the security-conscious AP, procurement, and SOX reviewer: data handling, access controls, observability, and the current SOC 2 Type II status. They are companions, not duplicates — same envelope, different audience.
›What is the current SOC 2 Type II status?
VeraStream is in observation for SOC 2 Type II. The artifact itself is owner-supplied and not yet published on this page — we do not claim certifications we have not yet earned. The status row on this page reads "Pending — artifact owner-supplied" so reviewers can see where the report stands at a glance.
- Status row: "Pending — artifact owner-supplied".
- Observation window begins after SOC 2 Type I completes.
- The artifact will be linked from this slot and from the DPA exhibit once delivered.
›Where does VeraStream store data, and for how long?
Production tenants ship in Render's Oregon region by default; enterprise plans can be provisioned in a dedicated EU region. Uploaded CSVs and in-progress run reports have a 90-day default retention, customer-configurable per tenant. Customer-managed deletion is available from the tenant console, and a written request to verastream@polsia.app triggers full tenant deletion confirmed in writing within 30 days.
›How are access controls enforced?
Internal access follows least privilege: read-only roles for support, write only on the auditor-facing endpoints, no broad data-export role for any team. RBAC ties into the better-auth admin plugin, so role assignments and revocations are auditable. Production data is never present in dev or staging — internal testers run against fully synthetic or fully anonymised slices.
›How are audit runs shared externally?
Every shared report is gated by a signed, single-purpose download token issued by /api/audit/download/[id], tied to that specific report ID and recipient. Tokens expire and cannot be reused across reports. The audit run itself can be exported as a PDF in-browser via the /audit PDF route; the artifact is generated client-side, not server-side, so the same report never lands on our disk twice.
Test the controls yourself
Run the envelope, or compare packaging
Drop a CSV at /audit to exercise the same eight-detector pipeline on your own disbursements, or check the VeraStream packaging for the row volume and SLA bands behind the controls just described.