What we hold, and why.

Version 2026-09. When these change, the version changes, and existing customers are told before it applies to them.

Veristep exists to keep a record. This page says what goes into that record about people, what we collect about you on the website, where it lives, and what you can ask us to do with it.

1. What the platform records about people

Account details: name, work email, phone if given, the organization and role you hold, and sign-in events (time, IP address, device) — the last of these is the security trail and is append-only.
Work you attest to: inspections, evidence, photographs, signatures, documents, approvals, hours and, where a project turns it on, GPS presence at the moment of a check-in or a captured photograph. These are the record and are kept for as long as the tenant that owns them exists.
Credentials people upload about themselves (certifications, clearances) and the dates on them.

The organization that admitted you to its workspace controls this data. Veristep processes it on that organization’s instructions. Ask them first about correcting or removing it; ask us if you cannot reach them.

2. What the website collects

The public site sets no advertising cookies and runs no third-party trackers. We count page views, tour steps and form submissions in aggregate to see which pages work. If you request a call or start a trial, we keep what you typed so we can answer you.

3. Where it lives

Data is stored with Supabase (PostgreSQL and object storage) and served through Vercel, both in the United States. Files are held in private storage and reached only through short-lived, signed links issued to a signed-in person the database allows to see them. The AI workforce reads the records it drafts against; the model provider receives only the text needed for that draft. Which providers we use, and their data terms, are listed under Subprocessors on the Security page.

4. Who can see it

Your organization’s administrators decide who is admitted to its workspace and in what role; the database enforces that boundary between organizations. Veristep staff can reach a tenant’s data only to operate the service or on that tenant’s request, and that access is limited to the platform’s named administrators. We do not sell personal data and we do not share it with anyone except the processors above and where the law requires.

5. How long

For as long as the organization is a customer, and for ninety days after a plan ends so that it can export everything.
The audit spine — events, sign-ins, security entries — is append-only by design and stays sealed after a workspace closes, unreachable to anyone.
Website enquiries are kept for two years.

6. Your rights

You can ask what we hold about you, ask for it to be corrected, ask for a copy, or object to a use. Where the record is a tenant’s, we route the request to that tenant’s administrator and help them answer. Where a record is append-only we will explain what that means for the request rather than pretend otherwise. Write to the address on the Talk to someone page; we answer within thirty days.

7. Changes

A new version of this page gets a new version number. Material changes are announced to every tenant administrator before they take effect.