Jurisdictions trust us with property records, enforcement evidence and information about property owners. Here's how we look after it. If your procurement or IT team has a security questionnaire, send it to [email protected] and we'll complete it.

Where your information lives

  • VeriStay runs on DigitalOcean, in data centers in the United States.
  • Uploaded and generated files (evidence screenshots, reports, letters, attachments) are kept in private storage. They're never public: the app hands out signed links that stop working after an hour.
  • Listing collection runs on a separate server from the website.
  • You can see whether the website, database and listing collection are up on our status page, checked live.
  • Passwords, keys and other secrets are kept in encrypted settings, not in our code.

Encrypted connections

Every page and API request uses HTTPS. Browsers are told to use only HTTPS for VeriStay (HSTS), and the sign-in cookie is only ever sent over an encrypted connection.

Who can see what

  • Each account sees only its own jurisdictions. County administrators see the jurisdictions assigned to them, and nothing from anywhere else, in the app or through the API.
  • Roles limit what people can do. County administrators can review and act on their results, but can't change the identification work; scraping and registry tools are limited to VeriStay staff, and only VeriStay administrators can create accounts or change what they can see.
  • New accounts start with no access. Someone who signs up sees nothing until VeriStay assigns them to a jurisdiction.

Accounts and sign-in

  • Passwords are stored only as salted, slow hashes (PBKDF2), never in readable form. Weak, common and all-number passwords are refused.
  • Every sign-in is logged, along with failed attempts, sign-outs and API key requests, with the time, IP address and browser. Administrators can review the log.
  • API keys belong to a person, see only that person's jurisdictions, and can be replaced at any time.
  • Single sign-on and two-step sign-in aren't available yet. Ask us if you need them.

Sharing evidence safely

Each compliance report prints a QR code and an access code for its online version, so a letter's recipient can see the evidence without an account.

  • The link is a long random address, and the page asks for the separate access code before showing anything.
  • After 10 wrong codes, the link locks for 15 minutes.
  • These pages are hidden from search engines, and don't pass their address on to other sites.
  • A jurisdiction can reset a link and code at any time, which stops old copies from working.

Protecting the app

  • Forms are protected against submissions from other websites, and public forms use Cloudflare Turnstile to block automated spam.
  • Error pages don't reveal anything about how VeriStay is built.
  • The software we build on is kept up to date, and changes are tested before they're released.

Privacy

We don't sell information, use advertising or analytics trackers, or use a jurisdiction's information for anything but its own service. Our privacy policy lists what we collect and every company that helps us run VeriStay.

Reporting a security problem

If you think you've found a security problem in VeriStay, email [email protected] with "Security" in the subject. Tell us what you found and how to reproduce it. Please don't access, change or delete information that isn't yours, or disrupt the service, and give us a reasonable time to fix the problem before telling anyone else. We'll reply, keep you updated, and thank you for helping.

Security researchers can also find our contact details at /.well-known/security.txt.