Privacy notice
VERA holds as little personal information as it can. This notice covers two things: this website, and the VERA service that banks and lenders use.
1. Who we are
VERA Platform LLC, a Wyoming limited liability company (“VERA”, “we”). Questions about this notice: [email protected].
2. This website (verarails.com)
- No accounts, no tracking. The site has no sign-in, sets no cookies of its own, and runs no analytics or advertising scripts.
- The request form sends your request to us. When you press Send, the name, company, email address and message you typed go from your browser to our service (api.verarails.com), which emails them to us. We use them only to reply to you and to arrange a walkthrough. We keep them in the mailbox that receives them; they are not stored in the VERA service database, we send you no automated email, and we do not sell them or share them for advertising. A short log line records that a request arrived (a reference number and the domain of your email address, not your name or message).
- Connection data. The site is delivered through Cloudflare, and its typefaces are loaded from Google Fonts. Those providers receive your IP address and ordinary request information when you load a page, and handle it under their own policies.
3. The VERA service (app.verarails.com)
VERA’s customers are banks and lenders. For the information a customer puts into VERA about its loans, projects and people, the customer decides what is collected and why. VERA processes it on the customer’s behalf as its service provider, under a written agreement with the customer. The service holds:
| Category | What it includes |
|---|---|
| User accounts | Name, work email, role, the organization the user belongs to, last sign-in time |
| Sign-in security | A salted one-way hash of the password; an authenticator secret (stored encrypted) and hashed backup codes; the user’s public signing address. VERA never holds a user’s private signing key or signing passphrase |
| Activity records | An audit log of who did what, when, and from which network address |
| Project and draw data | Project name and address, site location, draw amounts and status, approvals and signatures, contractor names, lien-waiver records, site hazard-check results |
| Payment destination | A project’s routing and account numbers, stored encrypted |
| Documents | A fingerprint (hash) of each supporting document and a reference to it, not the document itself |
What the service is designed not to hold. The database has no fields for Social Security numbers, dates of birth, payment-card numbers or government ID numbers. Customers are instructed not to enter them in free-text fields.
4. How we use it
To run the service for the customer: to sign people in, enforce approvals, apply release checks, produce the audit record, provide examiner access, keep the service secure and give support. We do not sell data, and we do not use customer data for advertising.
5. Who can see it
- The customer’s own authorized users, according to their role. Examiner accounts are read-only.
- VERA personnel, only as needed to operate and support the service, and under the same two-step sign-in.
- Service providers, only as far as each needs to do its job: Google Cloud (hosting, key and secret management, backup storage); Neon, which runs on Amazon Web Services (the database); Cloudflare (DNS, edge and system email); read-only public hazard-data services (location queries for a project site); and the XRP Ledger, a public network that receives a hash only. During the pilot the ledger used is its test network.
6. Where it is kept
In the United States (Google Cloud us-east1; Neon on Amazon Web Services us-east-1). The only information that leaves the United States is a hash published on a public ledger. A hash is a fingerprint; it carries no names, amounts, account numbers or documents.
7. How long we keep it
Retention periods for a customer’s data are set in the customer’s agreement with VERA. The audit log is hash-chained, so individual entries are not removed during a customer’s term. Nightly database backups are kept for 35 days. Short-lived traffic data used to spot abnormal activity is kept for 48 hours.
8. How we protect it
Two-step sign-in is required on every account. Sensitive fields are encrypted at rest and all traffic uses TLS. See the Security page for more.
9. Your choices
- If your information is in VERA because of your job or your loan, ask your own employer or lender. They decide what is collected and are responsible for answering you. We help them respond. Deleting information may be limited by legal retention duties and by the hash-chained audit log.
- If you sent us a request or an email, write to [email protected] and we will tell you what we hold and delete it on request, unless we must keep it by law.
10. Children
This website and the service are for businesses and are not directed to children.
11. Changes
We will update this notice when our practices change and will show the date above. We will tell customers before a material change that affects their data.