Security at Verstavo
Verstavo helps commercial-real-estate credit professionals read risk in public and private loan data. Trust in how we handle your data is a precondition for that work. This page summarizes the controls we operate — and what we're still building.
Hosting & infrastructure
- Verstavo runs on Render, a SOC 2-audited cloud platform, with a managed PostgreSQL database. We operate no physical servers — physical and network security are provided and independently attested by our infrastructure provider.
Encryption
- In transit: all traffic is served over TLS / HTTPS. We do not offer unencrypted access.
- At rest: the database and its backups are encrypted at rest by our infrastructure provider.
Authentication & access
- Passwords are stored using argon2id, a modern, deliberately slow password hash — never in plaintext, never a fast hash, never in logs.
- Multi-factor authentication (TOTP) is enforced for administrative accounts.
- Access is role-based and organization-scoped: you can reach only your own organization's data.
- Sessions are hardened (HTTPS-only, HttpOnly, SameSite, finite lifetime), and authentication endpoints are rate-limited.
- Administrative and database access is limited to authorized personnel under least privilege.
Your data, and how we use AI
The core commitment
Your portfolio data stays inside our infrastructure. Customer portfolio holdings are not sent to any AI / model provider. AI-assisted features operate on public market and regulatory data only.
- Your data is yours. We do not sell it, and we do not share it with third parties for their own use.
- We do not use your data to train any AI model. Our AI features run on the Anthropic (Claude) API under commercial terms, and Anthropic does not train on data submitted via the API.
- Any future AI feature over portfolio data would send only aggregated, de-identified statistics — never a property's name, address, or location — and only under a data-processing agreement with zero data retention.
- We minimize the personal data we collect — an account name and email.
Secure development & change management
- All code is version-controlled; changes ship through pull requests with required automated review and status checks before reaching production.
- Secrets are stored in our provider's secret store — never in source code.
- Database access uses parameterized queries; passwords are never logged.
Availability & continuity
- Our managed database is backed up automatically by our infrastructure provider.
- We maintain and test recovery procedures for restoring service from backup.
Compliance & roadmap
- We are actively working toward SOC 2 Type II in progress across the Security, Availability, and Confidentiality criteria — a readiness assessment and control program are underway.
- A Data Processing Addendum is available on request.
- A current subprocessor list (Render, Stripe, Anthropic, GitHub, Google Workspace) is available on request.
- Payments are processed by Stripe; card data never touches Verstavo's systems.
Reporting a security issue
Found a vulnerability or have a security concern? Please reach us through our contact page. We investigate every report and appreciate responsible disclosure.
See the whole picture, not just the pulse.
Market Pulse is the free, public read. The Verstavo platform goes loan‑by‑loan — stress
scores, maturity walls, special‑servicing transfers, bank CRE, and your own portfolio benchmarked
against the market.