How Veyra handles evidence, insurance, sub-processors, disclosures, and incidents.

Raw evidence collected during an engagement — request/response captures, screenshots, terminal logs, intermediate notes — is retained for one year from delivery. Final reports are retained for three years. Test credentials issued to Veyra are deleted within seven days of final delivery.

Engagement data is processed only on Veyra-managed infrastructure. Evidence is encrypted at rest and in transit. Custody of every evidence artifact is logged in the engagement audit table.

Errors and omissions, cyber liability, and general liability insurance are required before external commercial delivery. Current carrier and limits are disclosed on request, in writing, to the named procurement contact at the engaging client.

Certificates of insurance are issued on request as part of vendor onboarding and are not posted publicly.

Engagement data is processed only by Veyra personnel and the named independent technical reviewer documented in the report. Sub-processors, when added, are disclosed to clients in writing before use, with the data category, the purpose, and the contractual basis stated.

Veyra maintains a current sub-processor list available to clients on request. Material additions are notified to existing engaged clients before the new sub-processor is given access.

Reports of security issues affecting Veyra infrastructure may be sent to security@veyrasecurity.io. Acknowledgement is sent within one business day. The reporter is updated on triage and remediation status; coordinated disclosure is the default.

The PGP key for security@veyrasecurity.io is published below. Reports submitted in plaintext are accepted but encrypted submission is preferred.

Where an incident affects client data, clients are notified within the timelines stated in the engagement Statement of Work. The notification names what occurred, the data category affected, the time window, the remediation status, and the named Veyra incident contact.

Incident timelines are not a default — they are negotiated per engagement and written into the SOW. The minimum standard Veyra contracts to is 72 hours for a confirmed incident affecting client data.