Veracross LLC

Veracross LLC is SOC 2 Type II compliant. On SOC2C this listing is Listed.

According to Veracross LLC's public trust center, Veracross LLC is PCI DSS compliant. On SOC2C this listing is Listed.

According to Veracross LLC's public trust center, Veracross LLC is GDPR compliant. On SOC2C this listing is Listed.

According to Veracross LLC's public trust center, Veracross LLC is CCPA compliant. On SOC2C this listing is Listed.

According to Veracross LLC's public trust center, Veracross LLC is HIPAA compliant. On SOC2C this listing is Listed.

Veracross employs advanced monitoring of the dark web using a tool called Recorded Future which automatically scans and collects data from dark web sources. This information is used to identify potential threats, such as leaked credentials or sensitive company information. When compromised credentials are detected, these high priority alerts are automatically routed to our internal IT team who then take the necessary steps to mitigate the risk. With the ability of Recorded Future to proactively detect potential threats, it allows us to take preventative measures like password resets or account lockouts before a bad actor can utilize these credentials in a malicious manner. By staying vigilant and proactive, Veracross is actively mitigating the risk of unauthorized access and potential data breaches, ensuring a higher level of security.

Veracross maintains datacenters in the US, Germany, Australia, and the Netherlands. In most cases, Veracross stores customer data in the geography closest to the customer.

Veracross takes data privacy & security seriously. You can read our support article here, outlining our commitments to our community. You can also look at the Controls we maintain and check out other FAQs.

Veracross has comprehensive backup and retention policies to ensure the security and availability of customer data. Veracross continuously backs up customer data in multiple redundant locations, with daily backups available for a rolling 30-day window and monthly backups available for one year. These backups are stored at both AWS and Azure, ensuring data is encrypted and secure. Veracross has procedures in place to guide the secure retention and disposal of both company and customer data. These procedures ensure that data is retained and disposed of according to compliance and regulatory requirements. For our services, Veracross does not own customer data, therefore data retention is controlled by our customers. Should a customer leave Veracross, we will provide the customer with their data in a portable format within 30 days of termination and then delete their data. All departing customer data will be automatically deleted from our backups within 90 days. Veracross maintains a disaster recovery plan that includes the ability to recreate infrastructure in a different cloud region, maintaining a Recovery Point Objective (RPO) of 15 minutes or less and a Recovery Time Objective (RTO) of 4 hours or less. This plan ensures that Veracross can respond and recover promptly in the event of a disaster.

Customer data is protected by TLS 1.2+ encryption when in-flight and AES-256 encryption when at rest.