Information Security Policy

About This Policy

This public policy explains the controls used by VerifyNow, operated by Urban Luxury Brands (Pty) Ltd trading as VerifyNow (Registration number: 2007/013732/07), to protect information handled through the platform. It applies to the website, dashboard, API, batch services, private file storage, and supporting operations.

VerifyNow is operated by Urban Luxury Brands (Pty) Ltd (registration 2007/013732/07).

The controls support confidentiality, integrity, availability, and POPIA-aligned processing. Each customer remains responsible for its lawful purpose, processing authority, user access, and instructions. The Data Processing Agreement records the parties' respective duties when VerifyNow acts as an operator.

Data Protection

Information in transit

• Production website, dashboard, and API connections use managed HTTPS encryption
• Customer API requests require a valid account key on protected routes
• Dashboard sessions use authenticated access for protected customer functions
• Service providers receive the information needed to fulfil the selected request

Stored information

• Private objects use AES-256 server-side encryption or an equivalent managed control
• Managed database services provide encryption at rest and access controls
• Batch and consent files remain private for their stated retention periods
• Payment processors handle card details and bank-account payment credentials

Ongoing AML data protection

VerifyNow supports data minimisation by using keyed HMAC-SHA-256 hashes and organisation-scoped random tokens to link ongoing AML enrolments. Screening responses retained for retries are encrypted with AES-256-GCM, which protects their contents and detects tampering, and expire from the active replay store after 48 hours. Cryptographic secrets are held in server configuration, separate from the stored responses, while HTTPS protects data in transit. Access controls protect retained audit and billing metadata. These measures support privacy while allowing repeat screening and an audit trail.

The separate Adverse Media Search API also encrypts saved retry responses with AES-256-GCM. Responses are bound to the request and expire from the active replay store after 48 hours.

Processing locations

• AWS temporary private-file storage takes place in Cape Town, South Africa
• Primary application request execution takes place in Cape Town, South Africa
• Document Intelligence analysis and isolated image rendering for enabled document workflows take place in Johannesburg, South Africa
• Managed Redis services run in Cape Town, South Africa. Global edge services may process request-routing and security information outside South Africa under the Data Processing Agreement.
• Temporary OTP code hashes, recipient-derived abuse tokens and retry payloads use encrypted Cape Town storage. Account and billing records retain opaque references under their applicable schedules.

Access Control

• Protected API routes require customer-specific credentials
• Protected dashboard functions require an authenticated user session
• Organisation and ownership checks guard access to eligible customer records
• Private file downloads require an ownership check and use signed links capped at five minutes

Access responsibilities

• VerifyNow limits privileged access to authorised personnel and service accounts
• Customers control their team members and remove access when a role changes
• Customers must keep API keys confidential and rotate a key after suspected exposure
• Audit metadata is recorded where a workflow supports security, billing, and support review

Infrastructure Security

• Managed edge infrastructure provides network-level DDoS protection
• A web application firewall filters common web attack patterns
• Rate limits and abuse controls protect selected routes and platform functions
• Managed serverless services reduce the infrastructure operated directly by VerifyNow

Infrastructure providers AWS and Vercel publish independent security certifications and audit information for their services. The AWS compliance programme and Vercel Trust Center describe the scope of that assurance. VerifyNow manages application access, service configuration and its operational security controls.

Our infrastructure providers hold certifications and audit reports according to their service scope. These include ISO/IEC 27001 certification and SOC 1 and SOC 2 Type II reports where applicable. AWS SOC assurance and Vercel security compliance describe their respective coverage.

VerifyNow does not currently hold its own ISO 27001 certification or SOC 2 report. Customers may submit a security questionnaire for a response on the controls and supporting evidence relevant to their assessment.

Maintenance

• Infrastructure providers maintain the underlying managed services
• VerifyNow reviews reported platform weaknesses and applies fixes according to risk
• Application dependencies receive security updates through the release process

Recovery

• Managed database services provide backup and recovery capabilities
• Private object retention follows the schedule for each workflow
• An RTO or RPO applies only when it is stated in a signed customer agreement

Regulatory Compliance

POPIA (Protection of Personal Information Act)

VerifyNow's controls support POPIA-aligned processing. The customer supplies the lawful purpose and authority for each check.

• The default verification purpose is identity fraud prevention and fraud detection
• Each request is limited to the fields needed by the selected service
• Retention periods follow the workflow and the applicable record-keeping duty
• VerifyNow supports documented data-subject requests within its role and legal duties

FICA (Financial Intelligence Centre Act)

Customers can use eligible services as part of their own risk-based FICA process. The customer decides which checks its risk management and compliance programme requires.

• Identity and company verification can support customer due diligence
• AML, sanctions, and PEP screening can support risk assessment
• Reference and billing metadata can support a customer's audit evidence

Retention and Secure Delivery

• Full reports from ordinary single checks are not stored by default after delivery
• Ongoing AML encrypted response replays expire after 48 hours. Identifier lookup mappings follow the enrolment retention schedule. The sub-processor register lists infrastructure providers, their purposes and processing locations.
• Self-service batch inputs, row results, and result files are retained for up to 30 days after completion
• Large-batch source uploads are retained for up to seven days
• Consent documents and consent evidence follow the current seven-year schedule
• Audit, billing, security, and account records follow their legal, accounting, security, or contractual periods

Eligible customer information can be returned or deleted under the Data Processing Agreement. Records required for legal, accounting, dispute, security, or compliance purposes remain subject to their applicable period.

Security Events and Incident Response

• Platform errors, performance signals, and relevant security events feed operational logs and alerts
• Reported or detected incidents are assessed, contained, and investigated according to their effect
• Material findings inform remediation and follow-up work

Responsible Disclosure

If you believe you have found a security vulnerability in VerifyNow, please report it to security@verifynow.co.za.

When testing, use test accounts only. Do not access, copy, retain, disclose, modify, or delete customer data, platform configuration, pricing, credentials, or other production records.

Do not perform denial-of-service testing, spam, phishing, social engineering, physical attacks, or any testing that disrupts our services or affects other users.

Please include enough detail for us to reproduce and assess the issue, such as affected URLs, approximate timestamps, test account email addresses, request details, and clear reproduction steps.

VerifyNow does not operate a public bug bounty program. Any commercial remediation services are handled separately through our normal procurement process and are not part of vulnerability disclosure handling.