Security.
How we handle the information in a verification, in the words of our policies.
Controls. Encryption, access and login.
- Information is encrypted in transit and at rest, access is limited to the people who need it, and logins run through a dedicated authentication provider.
- Security documentation is available to customers on request.
- No method of storage or transmission is completely secure.
In a verification. What we see, and how we treat it.
- In the course of a verification we may have incidental access to personal information and other confidential information in your systems.
- We treat it as confidential, use it only to perform the verification, retain it only as part of the working file and of any screen recording you provide, and disclose it only as the Privacy Policy states or the law requires.
- We do not record verification sessions.
- If we learn of unauthorized access to the company's information, we tell the company without undue delay.
From Terms of Service, section 4
- When a customer provides records for a verification, we handle them as the customer's service provider.
- We use them only to perform the verification, we take no custody of raw records beyond a working file of extracts and notes and any screen recording, held as section 8 states, and we do not show them to anyone outside the verification.
The working file. What stays after a verification.
- Other records provided for the verification are returned or deleted when the verification issues.
- We give the working file to a third party only with the company's written consent or when the law requires it.
From Verification Methods, section 6
How long each record is kept: Privacy Policy, section 8
Read-only keys. For a Direct extraction.
- When you give us a read-only API key, you warrant that it permits only reading, and that you have the right to grant the access it gives.
- We treat each key as confidential, use it only to perform the verification, and retain it until you remove it through the Service, ask us to delete it, or close your account.
Accounts. What we ask of each company.
- Keep your credentials confidential.
- Tell us at once if a credential is compromised.
Service providers. Who processes information for us.
Each service provider and what it does: Privacy Policy, section 6
Report a security issue. Write to hello@metricverification.com.
The same address is in security.txt.