Verisova reviews certificates of insurance against the requirements of the project the work is happening on. This policy explains what we collect when you use it, what we do with it, how long we keep it, and what happens when you delete your account.
Information We Collect
Account information
When you create an account we collect your name and email address from our authentication provider, and, if you set one up, your company or organization name. Sign-in, passwords and multi-factor authentication are handled by our authentication provider — we never see or store your password.
We also keep a short registration record — your name, your email address and the date you registered — which is retained in a limited form after account deletion. What it holds and why is set out in what we keep after account deletion.
Certificates you upload
A certificate of insurance you upload is read to extract the fields needed to review it: named insured, producer, certificate holder, policy numbers, effective and expiration dates, coverage limits, endorsements and the description of operations. Those extracted fields, the file name and the file size are stored against your account.
The uploaded PDF itself is not stored. It is held in memory only for as long as the review takes, passed to our document-processing service and to the AI model that reads it, and then discarded. We keep the extracted review, not the document.
Project and contractor information
If you use projects, we store the project details you enter — name, dates, insurance requirements and any contact name, email or phone you add — and which reviewed certificates are assigned to it.
Payment information
Subscriptions are billed through our payment processor. Card and bank details go directly to them and never reach our servers; we store the customer and subscription identifiers they give us, your plan, and your review usage against it.
Technical information
Our servers log ordinary request data — the time of a request, the route it hit, how long it took and its IP address — for security, rate limiting and debugging. We do not use IP addresses to decide who is eligible for a free trial, because people who work at the same company or on the same network legitimately share one.
How We Use Information
- To run the service: review your certificates, compare them against your project requirements and show you the results.
- To manage your account, subscription, review allowance and billing.
- To send you service email — organization invitations and replies to messages you send us.
- To keep the service secure and available, and to prevent abuse of the free trial.
- To comply with our legal, tax and accounting obligations.
We do not sell your information, and we do not use the certificates you upload to train AI models.
Who We Share It With
We use a small number of service providers, each for a specific purpose and each only receiving what that purpose needs:
- Clerk — authentication and account management (your email address and login activity).
- Anthropic — the AI model that reads your certificates (the page images of a certificate at the moment it is reviewed).
- Stripe — payments and invoicing (your email address and billing details you enter with them).
- Resend — transactional email delivery (recipient address and message content).
- Railway — application and database hosting (everything stored by the service).
We may also disclose information where we are legally required to, or where it is necessary to investigate fraud, abuse or a security incident.
How Long We Keep It
We keep your account information, reviewed certificates and projects for as long as your account is open. You can delete an individual certificate or project at any time from within the app, and you can delete your whole account from your account settings.
What Deleting Your Account Removes
Deleting your account removes, from our database:
- the certificates you uploaded and all of the review data extracted from them,
- your projects and their contractor assignments, if you were the last member of your organization,
- your organization membership, and the organization itself if nobody else is left in it,
- your subscription record, review allowance and credit history,
- your profile and account information, and
- your login, which is deleted with our authentication provider so you can no longer sign in.
Any active subscription is cancelled as part of the deletion, so you are not billed again.
What We Keep After Account Deletion
Deleting your account does not erase absolutely everything. A limited amount of information is retained where it is reasonably necessary for fraud prevention, preventing repeated use of the introductory offer, security, account and financial reconciliation, keeping minimal account-history records, and meeting our legal and regulatory obligations. Specifically:
- Registration record. We keep a single short record of the account having existed. It contains your name, your email address, the date you registered, the date the account was deleted, how many free COI Reviews the account used, whether the introductory offer was granted to it, and whether it was ever a paid subscriber. That is the whole of it. The record is not used to contact you and is not shared for marketing.
- Free-trial record. The introductory 2 free COI Reviews are a one-time offer per person. So that deleting an account and signing up again does not reissue them, we also keep a separate record noting that the introductory offer has been used. It holds a one-way cryptographic hash of your email address — not the address itself, and nothing that can be turned back into it — together with a flag and a date.
- Billing and payment records. Our payment processor keeps its own invoice and transaction records, which we are required to retain for tax and accounting purposes.
- Security logs. Server logs, which may include IP addresses, age out on their own retention schedule and are not deleted on request except where the law requires it.
Just as importantly, here is what those records do not contain. They hold no password, authentication token or session; no certificates of insurance and nothing extracted from them; no projects, contractors or review findings; no card or bank details and no billing information beyond the yes-or-no fact of having subscribed; and no IP address or browsing history. Nothing beyond the fields listed above is kept, and we do not treat this retention as a reason to hold anything else.
The records are held for as long as the purposes above apply, and they are reachable only by an authorized administrator through an internal, access-controlled view. If you believe we should not be holding yours, write to us at the address below and we will look at it — where we can honour that without reopening the introductory offer to repeated use, we will.
You can always create a new account
Your Choices and Rights
You can view and export your review and payment history from your account settings, correct your account details, delete individual certificates and projects, and delete your account. Depending on where you live you may also have the right to request a copy of the information we hold about you, to have it corrected, or to have it deleted — subject to the limited retention described above. Write to us and we will help.
Security
Data is encrypted in transit, held in a managed PostgreSQL database that is not exposed to the public internet, and reachable only through the authenticated application. Access is scoped to your account and, where you belong to one, your organization. No system is perfectly secure, but we do not keep what we do not need — which is why the uploaded PDFs are not retained at all.
Children
Verisova is a business tool and is not intended for anyone under 18. We do not knowingly collect information from children.
Changes to This Policy
If we change how we handle your information we will update this page and the date at the top of it. Continuing to use the service after a change means the updated policy applies.
Contact
Questions about this policy, or about the information we hold about you, can go to info@trionislabsai.io or through the .
Not legal advice