Skip to content

Where Your Files Go, and Who Sees Them

How Verra Protects Your Data

These measures cover both ways to run Verra: hosted by us, or in your firm's own cloud.

Zero Data Retention

AI models aren't trained on your files, questions or answers, by us or by our providers. Each request reaches them with its context through Verra's model gateway, and they keep nothing once it's answered.

SOC 2 and HIPAA

Our SOC 2 Type II report comes from an independent audit of how Verra's controls worked across a full review period. Verra also meets HIPAA requirements for health information, and we sign a business associate agreement with firms that need one.

Two Ways to Run Verra

Verra runs hosted by us in the United States or as a single tenant in your firm's own cloud, with the same product either way. The drawing shows how your people sign in, where your data is stored, what reaches the AI models for each answer, and, in your own cloud, what our team can reach.

We host and run Verra for your firm. Your people sign in with the firm's own single sign-on.

Hosting Details

Hosted and Own Cloud Compared

Row by row, how the two deployments differ. Pick the one your firm's security policy calls for.

Hosted by Verra

Where It Runs
Our cloud in the United States
Who Shares It
Firms share the app, and each firm's data is kept separate
Your Data
Stored in the United States
Entry Point
A web application firewall, with TLS
Model Gateway
Runs in our cloud
AI Models and Processing
Outside providers
Agent Sandbox
An outside provider in the United States
Audit Records
Kept write-once
Support Access
Audited views
Updates
Releases our team approves
Hosting Details

In Your Own Cloud

Where It Runs
A private cluster in your firm's cloud
Who Shares It
Your firm only
Your Data
Stored in your cloud, on private endpoints
Entry Point
A web application firewall over a private link
Model Gateway
Runs in your cloud
AI Models and Processing
Outside providers, through your firewall
Agent Sandbox
An outside provider in the United States
Audit Records
Streamed to your log workspace, with a write-once copy
Support Access
From one address you allow in, with audited views
Updates
The same releases, with images copied to your registry
Own Cloud Details

Controls

  • Single Sign-On and Admin Roles

    Your people sign in through your firm's identity provider over SAML or OIDC, on your verified domains, and removing someone from your directory ends their Verra access. Every request for your firm's data carries a signed token, and Verra refuses any without one. Admins can hand someone one area to run, such as usage or shared templates, without full admin rights.

  • Permissions and Sharing

    Verra answers only from the knowledge bases a person owns or was given. Each person's data sources sync under their own sign-in, every file keeps the permissions it has at its source, and Verra checks them before an answer uses the file. Chats stay private unless shared in a project, and admins choose which features each person or group can use.

  • AI Models, Storage and Encryption

    To answer a question, Verra sends the question and its context to AI models through a gateway we run, in our cloud or in yours. Those providers don't train on your data or keep it, and your security review gets the full list of providers and what each one receives. Hosted Verra stores your data in the United States, encrypted at rest and in transit, with each firm's data kept apart. In your own cloud, Verra stores it there.

  • The Agent's Code Sandbox

    When the agent runs code, it uses a sandbox of its own for each chat, run by an outside provider in the United States in both deployments. The sandbox reaches only software packages and your chat's files, can't reach Verra's main app or your connected sources, and stops on its own when idle.

  • Audit Records and Logs

    Verra records who acted, on what and whether it worked, never the contents of your documents or prompts. Hosted records are stored write-once, and in your own cloud they stream to your log workspace for your security tools. When our support team views a chat to help, the view is recorded too, and cloud audit trails, threat detection and network flow logs run on both deployments.

Questions Security Teams Ask

The questions a firm's security and IT teams ask us most, with short answers. Our team goes through the rest with your IT team in a walkthrough of how your deployment is set up.

Is Verra audited?

Yes. Verra holds a SOC 2 Type II report and meets HIPAA requirements, and we sign a business associate agreement with firms that need one.

Can Verra change a document without asking?

Not in Office. Before every edit it shows what it wants to change and waits for you to allow or deny it.

Which systems does it connect to?

The systems where most firms already store their documents and email, synced as they change. Anything else comes in as an upload.

What happens when someone leaves the firm?

Remove them from your directory and their Verra access ends.

Where does hosted Verra run?

In our cloud in the United States, with copies of stored files kept in a second US region.

If we run Verra in our own cloud, does anything leave it?

Yes. Requests to AI models leave it, and so does work sent to a few outside services, such as the agent's sandbox. Verra stores your data in your cloud.

Book a Walkthrough for Your IT Team

Request a Demo