Trust and verification

Trust centre

What we can show, how you can check it yourself, and what is not yet proven. Where something is not proven, this page says so.

Where we stand

Seven layers, as of 23 October 2026. The left column is what holds; the right column is what we have not yet shown.

Layer	What holds today	Not yet
Egress boundary	Originals stay on the device (X-Ray) or in the Vera environment (Shield). The hosts the extension may contact are fixed in its manifest and guarded by a test; a network-capture test runs in the build.	A standalone no-egress report repeated by an external party.
Key management	Mappings are encrypted and authenticated before they are stored.	A production key-management document and an independent cryptography review.
Gate and allowlist	The outbound privacy gate blocks when an original value remains; the extension’s allowed hosts are listed in the egress inventory.	A published specification of the gate’s rules and failure behaviour.
Build and supply chain	The packages are rebuilt to the same bytes (checked on Linux and macOS in every build); an SBOM is produced with each build; the SHA-256 of the 1.0.28 packages is below.	A signed provenance attestation, and an SBOM attached to each release.
Run evidence	The Shield keeps a run log.	A signed receipt per run that a customer can verify offline.
External review	A published penetration test of the SaaS environment, and review by Google, Mozilla and Microsoft before Vera X-Ray 1.0.28 was published.	Independent testing of the extension, the gate and the detection corpus; the re-test of two findings.
Evidence about the content	Verified by Vera: signed, time-stamped, checkable by anyone.	A published measurement of the Evidence Engine on Dutch and English professional statements.

Check it yourself

A Verified by Vera certificate: how to verify the signature, the chain and the timestamp, with the commands.
How the Evidence Engine reaches a verdict: steps, source policy and limits.
How the Privacy Shield works: process and log fields.
How Vera’s behaviour is tested: tests, including runs that did not pass.

External review

Penetration test of the SaaS environment. Tested by Daniel Kostovski between 23 and 27 September 2026 (grey-box): no critical or high findings, one medium and five low or informational findings; 38 controls verified; all six findings handled the same day. The report includes the remediation log, one finding we could not reproduce and left in place, and one partial remediation. The re-test of two findings is planned and has not been carried out. Read the full report.

The test covered the SaaS environment. It did not cover the browser extension, the Privacy Shield gate or the detection models; those are not yet independently tested.

Store review. Vera X-Ray 1.0.28 was reviewed and published by Google (Chrome Web Store), Microsoft (Edge Add-ons) and Mozilla (Firefox Add-ons) on 16 October 2026.

Vera X-Ray 1.0.28 packages

SHA-256 of the packages as submitted to the stores. A store may repack or re-sign a package, so the file a store serves can have a different hash.

Package	SHA-256
`xray-chrome-1.0.28.zip`	`ac9133f51e86a73e7850a18413a39d0aea6000ff698e7ed3a3bce9a12583e9e3`
`xray-firefox-1.0.28.zip`	`399f8addc9b6b1d388fc7f7ee54e00c7c73efb76349d474dc9ee87bf5fd323a4`
`xray-source-1.0.28.zip`	`c5a190a0f8d551fb0051bb2def4f9adf90622d2d02b63c80fc94ddfbab1d57e0`

Limitations

Detection is not complete for free text, and every result needs your review before you approve. The detection results are measured on synthetic documents; real documents will score lower, and no external reviewer has checked a sample yet.
Vera X-Ray restores values locally after Vera’s answer. That restore path and the local owner of the device are residual risks, not excluded ones.
A manifest list of allowed hosts is not an operating-system guarantee.
The Verified by Vera signature and timestamp are not qualified under eIDAS. A certificate shows that a source says something, not that the source is right.
A public revocation list for the signing certificate is not published.

Reporting a vulnerability

Report it to security@iamvera.ai. The policy, scope and safe harbour are in the security policy; the machine-readable version is security.txt.

The source code of Vera X-Ray is in a private repository. A buyer who needs to inspect it asks for access first.

Last updated: 23 October 2026. Vera X-Ray version 1.0.28.