Each organisation on its own
On every query, the database checks that whoever is asking is a member of the organisation.
Security for IT departments
Everything to review Verkio against, on one page
Where Verkio stores data, which providers process it, how sign-in, permissions, logging and deletion work and how AI calls are handled. A brief for your IT department.
At a glanceWhat IT usually asks first.
- Storage
- Database, files and search index in Stockholm.
- Hosting
- The servers that process your documents run in Stockholm.
- Encryption
- TLS between the browser and Verkio, and encrypted at rest with the storage provider.
- Sign-in
- A six-digit code sent to the email address, valid for an hour, or your Microsoft account through Entra ID, which an Enterprise organisation can require. There are no passwords.
- Permissions
- Each organisation sees only its own content. The database checks membership on every query, with row-level security in PostgreSQL.
- Roles
- Admin and member. An admin adds and removes members.
- Logging
- Every addition, change and removal is recorded with who and when.
- Support access
- Only when your admin grants it, for a set time and read-only. Every visit is logged and shown to you.
- AI
- Calls are made with zero data retention at the provider, and your documents aren't used to train models.
- Deletion
- All content is deleted 30 days after the agreement or trial ends.
- Cookies
- In the app, only those needed for sign-in. On the website, Google Analytics statistics if the visitor accepts.
- Installation
- None. Verkio runs in the browser.
Sub-processorsThe providers that process data on our behalf.
When personal data is transferred to a country outside the EU and EEA, it is protected by the European Commission's standard contractual clauses or the EU–US Data Privacy Framework. If your organisation needs the AI calls processed within the EU as well, get in touch.
Personal data and agreements
For personal data in your content, you are the controller and we are the processor. The terms set out our commitments as processor, including confidentiality, appropriate technical and organisational measures, using only the sub-processors listed in the privacy policy, and helping you respond to data subject requests.
We notify you without undue delay of any personal data breach.
Read more in our terms and privacy policy.
Common questions from ITShort answers to what IT usually asks.
Are the AI models trained on our documents?
No. Calls are made with zero data retention at the providers, and they don't train their models on them.
Can anyone at Verkio read our documents?
Not unless your admin has given us support access. Without it we see only names, counts, activity and cost. With it we can read for the time you've set, but not change anything, and every visit shows in your settings.
How are files protected?
Documents are kept in private storage. A file opens through a signed link that's valid for a limited time and is only created for members of the organisation.
Does Verkio need access to our systems?
No. You upload the documents you want Verkio to read, and nothing needs installing.
What happens when someone leaves?
An admin removes them from the organisation, and they can no longer reach any of your content.
Can we have everything removed?
Yes. You can delete documents, machines and the whole organisation, and the files are removed with them. Deleted data may remain in backups for a short time before it's overwritten.