Security & data protection
Plain facts about how we protect your data.
We only describe what is true today. If you need more detail for a vendor review, ask us.
✓Separate deployment and database per committee
Each committee runs on its own deployment with its own database. One committee's data is never stored with another's.
✓Hosting
VERDICT is hosted on Railway. The region is chosen per committee from the regions Railway offers (US, EU and Southeast Asia). In-country hosting is not available on Railway today; if your committee needs it, talk to us and we can discuss options.
✓Access control
Role-based permissions with configurable capabilities, sign-in attempt limits, password history and password reset.
✓Audit trail
Key actions are recorded in an audit log that administrators can review.
✓Verifiable documents
Approval letters, query letters and invoices can be checked by anyone on a public verification page.
✓Encryption in transit
All traffic to VERDICT is served over HTTPS.
Regulations and your obligations
VERDICT is designed to support committees' own record-keeping obligations, for example under the Common Rule, ICH E6(R3) principles, GDPR or national data protection laws such as Kenya's Data Protection Act. Compliance remains the committee's responsibility; we provide documentation for your vendor review.
VERDICT does not claim any third-party certification.
Request our security pack