Serious safeguards. Honest boundaries.
VERIDEX is built for authorized institutional use, with isolation, encryption and strict provider boundaries. It is just as careful about what it does not claim.
Built in today
These safeguards are part of the current release, not plans.
-
Sign-in bound to your tenant
Microsoft device-code sign-in. The ID token’s signature, issuer, audience and tenant are checked, and identity is taken only from signed claims, never from request parameters.
-
Hardened sessions
The session identifier is renewed at sign-in, requests are protected against cross-site forgery, cookies are HttpOnly and Secure, and sessions expire after 30 idle minutes or 8 hours in total.
-
Owner isolation
Each case is owned by one identity and resolved on the server. A case that belongs to someone else is answered as “not found”.
-
Encryption of sensitive evidence
Phone numbers and raw provider output are stored as AES-256-GCM ciphertext, with a separate keyed fingerprint so values can be matched without being decrypted.
-
One adapter per provider
Every external service is reached through a single adapter that validates inputs and outputs, enforces allowlists and budgets, and checks web destinations by URL and DNS.
-
A human review gate
Analysis reads only approved evidence, and each review decision is appended to an audit log that is never rewritten.
On and off, out of the box
A new deployment starts closed. Each external capability is switched on deliberately, and the most sensitive actions are limited to operators your institution names.
| Capability | Out of the box | What turns it on |
|---|---|---|
| AI analysis, assistant and AI report author | Built-in deterministic demo provider | Connecting an AI provider in your deployment |
| Visual AI analysis of images | On | Enabling a multimodal provider |
| Assistant web search | On | Configuration, then your approval of each specific disclosure |
| Public-web live search | On | A provider key and at least one approved domain |
| Instagram and phone or messaging collection | Available | A configured collection provider, then an explicit collect action in each case |
| Breach-data and carrier lookups | On | Explicit enablement |
| Instagram candidate enrichment | On | Naming each permitted operator |
| Email campaigns module | On | Enabling the module |
| Campaign sending | Nobody allowed | Naming each permitted operator; every campaign still needs approval |
| Directory graph context | On in the reference configuration | Already on. It shows sensitive internal attributes, so deployments should limit it to what the purpose needs. |
How evidence crosses the provider boundary
Every external service is reached through one validating adapter, and what comes back is stored as evidence with its provenance, never followed as an instruction.
Opening a page never collects anything.
- Inputs validated against the case
- Allowlists, budgets and pacing enforced
- Web destinations checked by URL and DNS rules
- Disclosures to new destinations need your approval
- Responses validated and bounded
- Raw provider output never drives pages or the model as instructions
Directory, collection, search or AI provider your deployment has configured.
With its source and provenance attached. Sensitive values, such as phone numbers and raw provider output, are encrypted at rest.
Who can see a case
Only its owner. Isolation is enforced on the server for every case and the material attached to it.
- Case for subject 1
- Case for subject 2
- Case for subject 3
Each case belongs to the identity that opened it, resolved on the server from the signed-in tenant and user. Asking for someone else’s case returns “not found”, never its contents.
Where data lives
VERIDEX runs inside your institution’s own deployment. This website has no connection to it.
- Directory profiles
- Profile pages are read live from the directory rather than kept as a copy. Directory facts are stored only when they become part of a case, such as its structured profile or a graph snapshot.
- Directory graph cache
- Raw graph results are cached per investigator and purged after 30 days.
- Collected media
- Stored on disk inside the deployment that runs VERIDEX. Nothing reaches this website.
- Reports
- Rendered once from a fixed snapshot and stored. Viewing or downloading never contacts a provider.
What we do not claim
-
VERIDEX does not verify identity
A directory match, a collected profile, a phone response or a qualifying web page is a lead, not proof. Codice Fiscale decoding is derived from the record and is not checked against any official register.
-
VERIDEX makes no compliance or certification claims
It does not certify conformity with GDPR or any other framework, and it does not currently record a legal basis or purpose for processing. Those decisions belong to your institution.
-
Signing in is not authorization
Today, every member of the configured tenant who signs in can use the investigation modules. Membership of your organization is not authorization for any processing activity.
Implemented and recommended
The difference matters, so we keep the two lists apart.
Implemented
- Available Owner isolation of cases
- Available Encryption of phone numbers and raw provider output
- Available Review gating of analysis input
- Available Safe-by-default provider configuration
- Available Audit log of review decisions and case deletions
Recommended next steps
- Planned An investigator role model, so that only authorized staff can investigate
- Planned Access policies for the shared candidate pool and website index
- Planned Recording the purpose and legal basis of each investigation
Who VERIDEX is for
The problem it addresses, the principles behind it, and the direction it is heading.