1. What Verdact can see
Stripe
You connect with Stripe Connect OAuth. We request the read_write scope, not read_only, so that filing can be switched on later without asking every merchant to authorize again. Today Verdact does not write to your Stripe account. Filing is turned off for everyone during the beta, and even when it is on, a filing needs your opt-in, your approval of the exact packet, and a record written before anything is sent. We read disputes, charges and early fraud warnings. We do not store your Stripe access token; we keep your Stripe account identifier. You can revoke access from your Stripe dashboard at any time.
Slack (optional)
Verdact asks for a Slack user token with these read-only scopes: channels:read, groups:read, channels:history, groups:history and users:read. Be aware of what that means: Slack's permission model lets that token read any channel the connecting person can see. The limit to the channel you open and the messages you pick is enforced by Verdact's own code, not by a Slack permission. Verdact reads Slack only when you start an evidence search for a dispute, never in the background. Slack tokens are encrypted before they are stored (AES-256-GCM, with versioned keys that support rotation).
Verdact does not connect to your inbox. Gmail is not offered to merchants. If you want an email thread in a packet, you upload it yourself.
Files you upload
Stored in our cloud storage provider, scoped to your workspace. Each file is hashed (SHA-256) when it is uploaded, and the packet you approve is bound to a hash of its content, so what is filed is what you approved.
Analytics
Our product analytics provider records usage against a pseudonymous account identifier, not your name or email. Session replay is on in production with all text and form inputs masked.
2. How it is protected
- In transit: the site is served over HTTPS with HSTS, and sends a Content-Security-Policy,
X-Frame-Options: DENY,nosniffand a strict referrer policy. - At rest: our database provider encrypts stored data with AES-256. Slack tokens get a second, application-level layer (above).
- Tenant isolation: row-level security is switched on for every table in the database. Writes to evidence, filing attempts and audit records happen only in server-side code.
- Passwords: new passwords are checked against a public list of breached passwords. Only the first five characters of a hash leave our server, so neither the password nor its full hash is sent. If that service is unreachable the check is skipped rather than blocking sign-up.
- Stripe webhooks: every event is signature-verified before it is stored or processed.
- Abuse limits: the public audit and waitlist forms are rate limited, and they store a one-way hash of the visitor's IP address, not the address.
- Dependencies: we track security advisories with GitHub Dependabot and
npm audit. We do not publish a patch-time commitment.
3. What the AI does with your data
Verdact sends the evidence text and documents you include in a dispute to an AI provider to draft a response and read documents. The output is a draft that you review and approve; Verdact does not file anything for you during the beta. As stated in our Privacy Policy, your connected Slack data is not used to train AI models. The AI provider's own terms govern how it handles inputs; we do not make a claim about its retention.
4. Who processes your data
These providers process data on our behalf. The same list appears in the Privacy Policy, which also says what data reaches each one. Stripe and Slack are services you connect yourself, so they are described there rather than here.
- Cloud database and storage providerDatabase, sign-in and file storage, hosted in the United States
- Hosting and site-analytics providerWebsite hosting, request logs, and aggregate page-view and performance measurement
- Background-job providerRuns background tasks such as syncing disputes and sending reminders
- AI providerAI drafting and document reading on the evidence you include
- Email delivery providerTransactional email delivery
- Product analytics providerProduct analytics and masked session replay
- Password-safety serviceChecks new passwords against a public list of breached passwords
5. Your controls and retention
- Disconnect Stripe from Settings, and Slack from your Slack admin settings.
- Ask for export or deletion by email to admin@verdact.io. Deletion is processed within 30 days (our reply to your request comes within 2 business days). There is no one-click export yet; exports are prepared by hand.
- On deletion we remove your personal data and keep a de-identified record of any filing we made for you. Exactly what is kept is listed in the Privacy Policy.
- Raw imports not kept in an evidence record are deleted within 90 days of the dispute closing.
- Evidence records are kept for at least 24 months, longer where card-network, legal, tax or audit rules require it.
6. What we do not have yet
Better you hear it from us than find it in a vendor review. As of November 7, 2026:
- No SOC 2 report, no ISO 27001 certification and no third-party penetration test.
- No published Data Processing Agreement. If you need one, email us what you need and we will tell you plainly whether we can sign it.
- No published breach-notification commitment. We will not publish a promise we have not built the process to keep.
- No choice of data region. The database is hosted in the US East region.
- One person operates Verdact and reads each beta packet. There is no support team, no on-call rota and no status page.
7. Who operates Verdact, and reporting a problem
Verdact is operated by Verdact LLC, a Wyoming limited liability company. To report a security concern, email admin@verdact.io with the subject "Security report". Please do not include customer data in the first message. What is in scope and what to expect from us is on the vulnerability disclosure page.