Secure Operations and Customer Data Protection
Secure Operations and Customer Data Protection
At Verified, security is embedded in both the products we build and the way we operate our business. We apply security-by-design principles across our technology, internal processes, and day-to-day operations, with a focus on protecting customer data, maintaining accountability, and supporting the resilience of our services.
Our operational security practices are based on recognised industry standards and security management principles, including ISO 27001, as well as the heightened expectations for security, resilience, and operational oversight within the financial services sector.
Access to Customer Data
Access to customer data is restricted to authorised personnel and governed by defined access controls and legitimate business needs. We apply the principle of least privilege, ensuring that access is limited to what is necessary to perform an assigned responsibility or fulfil a specific customer request.
Within our SaaS platform, customer data is handled according to established security requirements. Employees and contractors receive security awareness training during onboarding, including guidance on the secure handling of customer information, their individual responsibilities, and the appropriate use of privileged access.
Access to customer data within our applications is limited to authorised Verified personnel. Where technical access to infrastructure is required, authentication relies on individual, passphrase-protected public keys, and SSH connections to servers are restricted to approved Verified locations. Access to customer data and relevant systems is logged to support traceability, accountability, and security investigations.
Unauthorised or inappropriate access is treated as a security incident and managed through our established incident management process. This includes assessing the nature and impact of the incident, coordinating the appropriate response, and notifying affected customers where required by applicable obligations and contractual commitments.
Support Access
Our Support and Reliability Operations teams access cloud-based systems and applications only to the extent necessary to perform their assigned responsibilities, maintain service health, and resolve technical issues.
Access to customer data for support purposes is restricted to legitimate operational needs, including resolving customer-reported issues through our support system. Where access to customer data is necessary to investigate or resolve an open support ticket, it is limited to the scope of the request and the actions required to address the issue.
Our operational approach emphasises controlled access, traceability, and accountability. These principles support the secure delivery and maintenance of our SaaS services and align with the operational resilience expectations relevant to customers in regulated industries, including financial services.
Training and Awareness
Our security training and awareness program doesn’t just check compliance boxes but results in a genuine uplift in knowledge across the company.
Our awareness program is built on the premise that security is the responsibility of everyone. These responsibilities are extracted from our internal Security Policy Program, and the training and awareness program is used as the primary vehicle for communicating these responsibilities to our staff.
Candidates and contractors are required to sign a confidentiality agreement prior to starting with us, and subsequently, during the onboarding process, security awareness courses are delivered to these new hires.
Keeping in line with the theme of ‘continuous improvement’, we disseminate security messages through company-wide messages and blog posts. These messages generally carry a message that is relevant at that time, e.g. a newly discovered and published threat, and reinforces the importance of following security good practices.
Employee Hiring
Verified is a compliant partner and issuer of BankID in Norway and Sweden. Merchants get their certificates issued through Verified. Verified adheres to the current requirements of BankID to keep this status/position. BankID meets the banks’ own high standards for Internet banking security.
Customer Exit Procedure
If a contract between Verified and one of our customers using our cloud products ends, customer data will be removed from our cloud environment according to the timelines below.
Scenarios where customer contract can end include:
- Missed payments: Where an existing customer misses a payment for their product subscription (whether monthly or annually)
- Subscription cancellation: Where an existing customer cancels their subscription
Data retention and destruction
Your account and associated users will be deactivated when your subscription ends. Verified retains data for deactivated accounts after the end of your current subscription period for 30 days.
Your data cannot be recovered after it’s deleted. We strongly recommend creating a Verified data backup from the archive. This can be done manually or via the API.