Skip to content
VerifyED
Sign in

Trust

What VerifyED stores, how long it keeps it, and who else sees it. Every line on this page is checked against the code that runs the product, not against a roadmap.

Where your data goes

There are two paths through VerifyED. Only one of them ever sees a student record, and only because you upload it.

Looking up a school

No student data is involved. You search for an institution, not a person.

  1. You send

    A school name, a country, or a CEEB code.

  2. We match

    Against 1.3M government school records and known diploma mills.

  3. We keep

    A sanitised copy of the query for usage analytics. Emails and long numbers are stripped first.

What that means: Nothing about an applicant is required, and nothing about an applicant is stored.

Reading a transcript

This is the only feature that receives student data, and only because you upload it.

  1. You send

    One transcript or diploma, up to 8 MB.

  2. We extract

    A model reads the document and returns structured fields. The request requires a zero-retention endpoint.

  3. We keep

    Signed in: the file and the result for 30 days, in private storage with no public URL. Not signed in: nothing.

What that means: You can delete it before the 30 days are up, and a scheduled job deletes it after.

How long we keep it

A scheduled job runs every four hours and deletes anything past its date. Transcripts are set to 30 days, and the code refuses any setting above 90 — pushing it higher would take a code change, not a config change.

Retention periods by data type
What How long
Uploaded transcript, not signed in Not stored at all
Uploaded transcript and extracted result, signed in 30 days, or until you delete it
Search queries (sanitised, no emails or long numbers) 3 months
Web analytics (no cookies, no IP addresses, daily-rotating identifiers) 3 months
Bulk screening upload 24 hours
Bulk screening results 7 days
Rate-limit counter (keyed on API key, or on IP address if you have none) Twice the rate-limit window — minutes
Sign-in session 30 days
Password reset link 1 hour
Account details and case files Until you delete them

Who else touches it

Every company that processes anything on our behalf. 3 of the 10 can see an uploaded transcript; the rest only ever receive school records or your account details.

Subprocessors and what each one receives
Can see a transcript Company What they receive
Yes Cloudflare All hosting, storage and networking — the application, its databases, and uploaded files.
Yes OpenRouter The uploaded transcript, routed to a model endpoint under a zero-retention requirement.
Yes Google (Gemini, via OpenRouter) The uploaded transcript, as the model that performs the extraction.
No Google Maps Platform School addresses and coordinates, for Street View and address validation.
No Google Identity Your email address, if you sign in with Google.
No Perplexity School names and locations, for research on an institution.
No OpenCage and OpenStreetMap School addresses, for geocoding.
No Stripe Billing contact and payment details. We never see a full card number.
No Resend Your email address and the text of service emails we send you.
No GitHub Whatever you type into the feedback box, if you use it.

How it's protected

Encrypted at rest and in transit
Every database, cache and uploaded file is encrypted at rest with AES-256-GCM by Cloudflare, and reached over TLS.
Uploaded files have no public URL
They're stored under two random identifiers, in a bucket only the server can read.
Passwords are never stored
We keep a PBKDF2-SHA256 hash with 100,000 iterations and a unique salt. API keys are hashed too.
We honour Do Not Track and Global Privacy Control
With either signal on, the browser sends no analytics and the server drops anything that arrives anyway.
No analytics cookies, and no IP addresses in analytics
Visitor identifiers are hashed with a daily-rotating salt, so yesterday's can't be joined to today's. The one place an address is held is the anti-abuse rate counter, for minutes.
We don't train on your data
Transcript extraction runs only on endpoints that require zero data retention, and nothing you upload is sent to a second model.

Where we stand

We'd rather you knew what's missing before you start a review than after.

HECVAT 4.1.6 Critical questions answered
We've answered the Critical Importance set — the questions a "Lite" review covers — against our own code. The rest of the workbook isn't done yet. Email us and we'll send what we have.
FERPA Posture statement available
We act as a school official under your direct control when your agreement says so, and we use education records only to answer the request you made.
Data processing agreement On request
We'll sign yours, or send ours.
SOC 2 Type 2 Planned, not started
It's the prerequisite for most of what comes after, so it's first.
TX-RAMP Planned, not started
We'll begin when a Texas public institution needs it. SOC 2 comes first, and the two together take most vendors of our size 12 to 20 months.
Penetration test Planned, not started
Scheduled alongside SOC 2, by an outside firm.

Ask for a DPA or a questionnaire

Send us your data processing agreement and we'll review and sign it, or ask and we'll send ours. Same for our HECVAT answers and our FERPA posture statement. A person reads these, so tell us what your office needs.

Email [email protected] Read the privacy policy