Data protection
How we protect your data
Plain answers to the questions your board, donors and auditors will ask: who is involved, where your data lives, and what we do with it.
Last updated 20 October 2026
Who does what
Your organisation: the data controller
For every name, identifier and decision you enter, your organisation decides why and how it is processed. You can export it, correct it or ask us to delete it where the law allows.
VerityScan: the data processor
We process screening data only to provide the service, on your instructions, under a data processing agreement signed at onboarding. We never sell it, never use it for advertising, and never use it to train AI models.
When we are the controller
For free-trial sign-ups and marketing emails you opt into, VerityScan is the controller. You can unsubscribe at any time with one click.
Where your data lives
VerityScan runs on dedicated servers in Germany, within the European Union, operated by an established European hosting provider under contract with us. Data is protected by the EU's General Data Protection Regulation and by our obligations under Kenya's Data Protection Act 2019, Nigeria's Data Protection Act 2023 and South Africa's POPIA. Encrypted backups stay in the EU. Transfers from African countries rely on contractual safeguards in your data processing agreement.
Third parties involved
We keep this list short and tell organisations before adding a new one.
| Service | What for | Where | What they receive |
|---|---|---|---|
| Hosting provider | Servers and encrypted backups | Germany (EU) | Application data, with sensitive fields encrypted at rest |
| Email delivery service | Account and opt-in emails | European Union | Recipient address and message. Never screening results. |
| Website analytics | Anonymous visitor statistics | European Union | Page views only, and only after you accept cookies. Never names, emails or results. |
| Accessibility tool | On-page accessibility options | United States | Accessibility preferences only. No screening data. |
| Sanctions data suppliers | Official lists and debarments | European Union | Nothing. We download their lists; your data never leaves VerityScan. |
How we keep it safe
- Identifiers, dates of birth and decision notes are encrypted at rest with AES-GCM; all traffic uses TLS.
- Org Admins and Reviewers must use two-step sign-in, and accounts lock after repeated failed attempts.
- Every organisation's data is kept separate, and access is checked on every request.
- An append-only, hash-chained audit trail records every action, so any change is detectable.
- Nightly encrypted backups, kept for 30 days and 12 months.
How long we keep it
Screening records, decisions and audit events are kept for 7 years by default (never less than 5), as anti-money-laundering rules require. Your Org Admin can extend this to meet local law. Free-trial searches are deleted after 90 days.
Your rights and requests
People whose data is processed can ask for access, correction or deletion where the law allows. Legal retention duties can override deletion of screening records. Write to us and we will respond within the time your law requires.
Questions or a data processing agreement
Email privacy@verityscan.africa for our data processing agreement, a security questionnaire or any data protection question.