Security at verapli
verapli sits between you and the accounts your business depends on. So it is designed around one idea: we should never be able to see your keys, your documents or your identity — and that should be enforced by code, not by good intentions.
Our hard rules
- The human presses submit. The software may fill fields and highlight buttons. It never clicks submit, create or send; never accepts terms; never touches CAPTCHAs, 2FA codes or payment details; never uploads identity documents; never creates an account at a provider; never deletes or revokes anything. This is enforced by a policy engine, not an AI prompt.
- No account bots. No CAPTCHA solving, no aged or purchased accounts, no evading provider integrity systems.
- Keys never leave the browser. Captured by deterministic code (never read by an AI model), encrypted with WebCrypto, stored in IndexedDB, and written only to your own files or your own vault. Never in a network request, AI prompt, log, telemetry or browser sync.
- No identity hoarding. Your identity profile lives encrypted on your machine. Documents go straight from you to the provider. Our servers hold no secrets and no identity profiles.
- Enforcement, not promises. One outbound gate for every network call scans for key patterns and for every value in your vault. A redactor runs before any text reaches an AI model. Secret values have a type that cannot be serialised. Modules that hold secrets are not allowed to import network or AI code. Every test fixture contains canary keys, and a single canary in any outbound request blocks a release.
- Agents are untrusted. Starting anything needs a pairing you approve. No agent-facing tool returns a secret, submits or pays. Every agent action goes in a local audit log.
verapli is in early access. These rules are the design the extension and agent bridge are built and tested against; we will publish independent review results when we have them.
Data classes
| Class | Examples | Lives in | Protection |
|---|---|---|---|
| Public | Registry entries, terms cards, web guides, published aggregate outcomes (only groups of 20 or more) | Our servers, CDN, your browser | Signed, not secret |
| Private | Your identity profile (legal name, company number, address, VAT, D-U-N-S, phone), project names, plans | Your browser only | Identity profile encrypted on your machine |
| Secret | Provider API keys, tokens, client secrets, webhook secrets | Your browser’s encrypted vault and your own .env files | AES-GCM in the browser; plaintext only in files you choose |
| Operational | Your email, plan, Stripe customer id, a hash of your licence key | Our database (Google Cloud, London) and Stripe | Google-managed encryption at rest |
What leaves your browser
| Data | Does it leave your browser? |
|---|---|
| Provider API keys and tokens | Never. Captured from the provider’s page, encrypted in the browser, written to your files. |
| Your identity profile | Only into the one field being filled, on that provider’s own website. |
| Identity documents | Never through verapli. You upload them directly to the provider. |
| Page text sent to the AI assistant | Only after a redactor removes keys, tokens, card and ID numbers, contact details and fields marked sensitive. Never screenshots. |
| Telemetry | Off by default. If you opt in: provider, step, outcome and wait times only — no names, domains, accounts or free text. |
| Licence key | Sent to our API to check your plan. It is not a provider secret and unlocks nothing outside verapli. |
This website and your account
- Hosted on Google Cloud in London (europe-west2). Data stored in Firestore in the same region.
- Payments by Stripe. We never see or store card details. Stripe’s hosted checkout and billing portal handle them.
- Your licence key is shown to you once. We store only a SHA-256 hash and the last four characters, so even we can’t read it back.
- Sign-in uses one-time email links (Firebase Authentication). No passwords. Your session is an HttpOnly, Secure cookie that page scripts can’t read.
- No advertising or analytics trackers. No third-party cookies. We count page views on the server without cookies or IP addresses.
- Strict Content Security Policy, HSTS, and no framing of our pages.
- Service secrets live in Google Secret Manager. No service-account keys.
Reporting a vulnerability
Email security@verapli.com with the details and steps to reproduce. Our machine-readable contact is at /.well-known/security.txt.
- We’ll acknowledge your report within 3 working days and keep you updated.
- If you act in good faith — avoid privacy violations, data destruction and service disruption, only test against accounts you own, and give us reasonable time to fix before disclosure — we won’t pursue legal action.
- In scope: verapli.com and its API, and (once available) the verapli extension and agent bridge. Out of scope: the providers verapli helps you with — please report those to them.
- We don’t run a paid bounty yet, but we’ll gladly credit you.