Veriff security & compliance
An overview of Veriff's security posture — compliance, penetration testing, subprocessors, and data handling — verified on SOC2C (Listed).
SOC 2 statusSOC 2 Type II · Listed
FrameworksSOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, GDPR, CCPA
Penetration testNot listed
Subprocessors17 listed
HostingAWS, GCP
Trust centerView
Security questions about Veriff
- Is Veriff secure?
- Security isn't a single yes/no, but Veriff is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, GDPR, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
- Does Veriff have a bug bounty or vulnerability disclosure program?
- Veriff hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@veriff.com or via a /security page.
- Who are Veriff's subprocessors?
- Veriff lists 17 subprocessors on its trust center, including Google Cloud EMEA, Amazon Web Services EMEA SARL, Veriff Spain S.L., Veriff UK Ltd, Veriff Inc., Veriff Brazil Ltda., Twilio Ireland Limited, Messente Communications OÜ. Buyers use this for fourth-party risk review.
- Where does Veriff host or store data?
- Veriff hosts on AWS, GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Biometric data. Data residency details are on its trust center.
- Where is Veriff's trust center or security page?
- Veriff's trust center is at https://trust.veriff.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.