1. Infrastructure
- The Verimly API, database and real-time service run on Google Cloud in the Netherlands (europe-west4). Web apps are served by Vercel from Frankfurt. See the Subprocessors page for details.
- All traffic is encrypted with TLS. Data at rest is encrypted at storage level by our hosting providers.
- The production database is backed up continuously with point-in-time recovery.
- Secrets and keys are kept in a managed secret store and are never stored in the database or source code.
2. Separation between businesses
Every query on business data is automatically limited to the organisation it belongs to. A business never sees another business’s data. For the Knownbee app, a business only sees the loyalty card a guest holds with that business, never the guest’s other memberships.
3. Accounts and sign-in
- Back-office users sign in with email and password, with optional two-factor authentication through an authenticator app. Resetting a password signs out all other sessions.
- Staff sign in to the POS with a personal 6-digit PIN. PINs are stored only as keyed hashes, attempts are throttled, and terminals lock automatically after inactivity.
- POS devices are paired to a location with a single-use code and receive their own revocable credentials.
- The staff portal and the Knownbee app use one-time codes sent by email or text message, valid for 10 minutes with a limited number of attempts. Codes, links and tokens are stored only as hashes.
4. Permissions and accountability
- Roles with granular permissions and limits on discounts, refunds and voids. Actions beyond a staff member’s limits need a manager’s PIN, and both people are recorded.
- An audit log records who changed what, on which device and when, with the values before and after the change.
5. Privacy by design
- We do not use third-party analytics, advertising or session recording tools in the back office, the POS, the guest pages, business websites, the staff portal or the Knownbee app.
- Message recipients are logged only as keyed hashes; message contents are not stored.
- Images uploaded for business websites are re-encoded and stripped of location and camera metadata.
- The AI assistant and agent (MCP) interface act only with the signed-in user’s own permissions, cannot make refunds, voids or payments, prepare every change as a proposal that a person confirms, mask guest contact details before data reaches AI models, and log every tool call. Agent keys are stored as hashes and can be revoked at any time.
- Guests can export and erase their data, and businesses can erase a guest’s profile while keeping their financial records intact.
6. Our team
Access to production systems is restricted to the people who need it, protected by multi-factor authentication and logged. Everyone with access is bound by confidentiality. We have an incident response procedure and notify affected businesses of a personal data breach within 48 hours of becoming aware of it.
7. Reporting a vulnerability
If you believe you have found a security vulnerability in Verimly, please report it to security@verimly.com. Describe the issue, the steps to reproduce it and its possible impact. We will acknowledge your report within three business days, keep you informed of our progress, and aim to resolve confirmed vulnerabilities within 90 days.
We will not take legal action against you for research carried out in good faith under this policy, provided that you:
- do not access, change or delete more data than needed to demonstrate the vulnerability, and do not access data of other people;
- do not disrupt the service, for example through denial-of-service attacks, spam or social engineering of our staff, customers or their guests;
- do not use physical attacks or attacks on our providers’ infrastructure;
- give us reasonable time to fix the problem before disclosing it to others; and
- do not use the vulnerability for any other purpose and delete any data obtained once the report is closed.