TRUST & SECURITY
A verification company
you can verify.
We sell proof, so we hold ourselves to the same standard: plain commitments, honest certification status, and nothing that depends on you taking our word for it.
Documents submitted for checking are processed for verification only. They are never used to train models, ours or anyone else's, and never shared. This is a contractual commitment in every pilot agreement, not a settings toggle.
Citation validity and quote accuracy are enforced in code, not prompted for: an invented rule or a quote that doesn't appear verbatim in your artefact is dropped before it ever reaches you. Rule classification itself is model-assisted, not encoded logic; we say so plainly rather than call it fully deterministic, and we don't overstate how much control we have over the model's own sampling behaviour.
Every check run is hashed (SHA-256) and chained to the previous record. Any retroactive edit breaks every subsequent hash, visibly. Receipts contain hashes, not your content; they cannot be reversed into your documents.
All traffic is TLS-encrypted in transit. The site and API are hosted on Vercel infrastructure; transactional email runs through Resend; analytics through PostHog (EU hosting). We keep the processor list short and current on our privacy page.
We collect the minimum needed to run a check and respond to you. Pilot enquiries are deleted after 24 months of inactivity. Audit records are the exception: retained for six years, matching the FCA's financial-promotion record-keeping expectations (COBS 4.11.3G), then deleted or anonymised. Erasure requests: one email, actioned within a month.
Where we are, stated plainly.
We are an early-stage company and we will not pretend otherwise with borrowed badges. This table is the current truth and it will be kept current.
Found a security issue?
Report it to security@velkron.xyz with “SECURITY” in the subject. We acknowledge within 48 hours and won't pursue good-faith researchers.