Trust Centre
How we protect the evidence you rely on.
V77 Trust holds compliance evidence for regulated organisations. This page states what we do today — and what we do not yet have — so your security and procurement teams can assess us quickly.
Authentication
Passwords are hashed with bcrypt. Every user can enable multi-factor authentication (TOTP authenticator apps) on every plan, and admins can require it for the whole workspace. Enterprise workspaces can use OIDC single sign-on.
Access control
Organisation-scoped roles — admin, AI owner, reviewer and read-only auditor. A session is bound to one organisation. API keys carry an explicit role, are stored only as SHA-256 hashes and can be revoked at any time.
Evidence integrity
Every evidence file is SHA-256 hashed on upload. Audit-log entries are hash-chained: each entry includes the hash of the one before, so an edited or deleted entry breaks the chain.
Proof Seal
On demand, V77 builds a Merkle tree over a workspace's evidence and audit-log hashes and anchors its root with an RFC 3161 timestamp from an independent timestamp authority. Anyone can check a seal at /verify, or offline with OpenSSL, without trusting V77.
Request hardening
Security headers on every response, CSRF protection on state-changing routes, rate limits on login and public forms, and organisation scoping on data queries.
Encryption
All traffic is served over HTTPS. Data at rest is stored in Cloudflare D1 and R2, which encrypt stored data. Webhook payloads are signed with HMAC-SHA256 so you can verify they came from V77.
Hosting & data residency
Customer data is stored in Cloudflare's EU jurisdiction: the D1 database and the R2 evidence bucket are created with EU jurisdiction, so data at rest stays inside the European Union.
Requests are served from Cloudflare's global network, so data in transit may pass through edge locations outside the EU.
Certifications
V77 Trust does not yet hold SOC 2 or ISO/IEC 27001 certification. We do not claim certifications we have not been audited for. Our security questionnaire answers, a Data Processing Agreement (GDPR Art. 28) and this subprocessor list are available on request from security@v77trust.com.
Subprocessors
Third parties that may process customer data on our behalf. We will update this list before adding a new subprocessor.
| Subprocessor | Purpose | Data | When used |
|---|---|---|---|
| Cloudflare, Inc. | Application hosting (Workers), database (D1), evidence storage (R2), default AI model inference (Workers AI) | All workspace data | Always |
| Stripe Payments Europe, Ltd. | Subscription billing | Billing contact, company and payment details | Paid plans |
| Paystack Payments Ltd. | Card billing outside the EU | Billing contact and payment details | Only when chosen at checkout |
| Resend, Inc. | Transactional email (invitations, password resets, reminders) | Recipient name and email address, message content | Always |
| OpenAI, Anthropic or Microsoft Azure OpenAI | Optional AI model evaluations and drafting assistance | Prompts and test content you submit to an evaluation | Only when that provider is enabled for your workspace |
| Timestamp authority (RFC 3161) | Independent timestamps for Proof Seals | A SHA-256 hash only — never evidence content | When a Proof Seal is created |
Vulnerability disclosure
Report security issues to security@v77trust.com (also published in security.txt). Please give us reasonable time to fix an issue before disclosing it, avoid accessing other customers' data, and don't degrade the service. We will not pursue legal action against good-faith research that follows these rules.
Questions about our security programme? security@v77trust.com or request a pilot. Operator: Vertex77 sp. z o.o., ul. Świeradowska 47, 02-662 Warszawa, Poland.