What is stored, and what leaves.

01Who is responsible for your data

Verity is software that someone runs. The organisation operating the instance you are signed in to is the controller of everything in your account, and it is the party you exercise your rights against. For this deployment that is operatorlegal entity, registered address and the contact for privacy questions is operatorprivacy contact address.

If you run Verity yourself, none of your data reaches the authors of the software. There is no phone-home, no licence check, and no telemetry endpoint in this codebase. Your controller is you.

02What Verity stores

An account holds only what the product needs to be the product. In a normal deployment that is:

• Account record. Email address, a password hash if you signed up with a password, and the provider identifier if you signed in with Google. Passwords are never stored in a readable form and never reach Verity’s own services.
• Conversations. Titles, messages, and the model responses to them, including any images or files you attach.
• Work you create. Projects, artifacts, knowledge base entries, flows, and offices, together with their schedules and run history.
• Memory. Facts the system has extracted from your conversations so it can carry context forward, the deterministic tags filed with them, and any correction or preference lessons you keep. When the Single Brain learning control is available, its consent record and review/audit records are stored with your account as well.
• Research work. Research questions, the source records you collect, selected evidence excerpts, claims, report drafts, and concise activity events that show real work performed. Activity records are not hidden reasoning transcripts.
• Connector configuration. Which MCP servers you have added and which header carries their credential. The credential itself is encrypted and is write-only: it can be set and replaced, and it is never returned by any API, not even to you.
• Usage ledger. An append-only record of metered actions, used to enforce your plan limits and to bill. It records that an action happened and what it cost, not what you said.

03Company workspaces and administrators

A Verity Business organization is a separate governed work area. It has active memberships, scoped roles, departments, workspaces, review assignments, setup progress, and concise redacted audit records. A role displayed in the interface is not authority by itself: the private service resolves active membership and permitted capability server-side.

Your existing personal conversations, memory, provider keys, files, Projects, Research records, and historical activity remain personal by default. Creating a company or completing Company Setup does not search, pool, copy, or transfer that material. Any future transfer feature must show its scope and effect for separate review and confirmation.

Invitations are created as expiring, revocable, one-time records. Only a token digest is stored. The current foundation does not send email, verify an invitation recipient, synchronize a directory, or activate a company runtime through the public static site.

04What leaves the deployment

This is the part worth reading closely, because it is the part people usually assume rather than check.

• Model providers. The Verity Gateway sends a request to the operator-configured provider for the selected Verity model. If you connect an approved provider key, such as an OpenRouter key, the request is sent to that provider under its own terms and retention policy instead. Provider keys are encrypted, write-only, and are not returned through the product. For this deployment the configured providers are operatorlist of model providers. Verity cannot make promises on their behalf, and neither should the operator.
• Pages you ask it to read. If you give the assistant a URL, the fetch service requests that page. The site you named will see a request.
• Connectors you add. An MCP server you configure receives the tool calls you approve, along with the credential you gave it. Adding a connector is a decision to share with a third party.
• Research sources. When you ask Verity to research a URL or use a connected research source, that source receives the request needed to retrieve the material. A report keeps the source and selected evidence linked so you can inspect what supports a finding.
• Optional Universal Brain learning. Only if you actively enable the control, Verity may submit a privacy-screened, generalized lesson or preference pattern for review. It does not submit your raw session, files, credentials, direct identifiers, or private links as a universal lesson. Your personal memory remains separate and takes precedence over any product-wide default.
• SpiderMesh. Distributed SpiderMesh participation is active. A request routed to the mesh is executed on contributed nodes as a bounded work unit, and a second node owned by somebody else recomputes it for the consensus check. Node operators receive the work unit, not your account, your identity, or anything else from your session.

Nothing else leaves. There is no analytics provider, no error-reporting service, no advertising network, and no data broker in this codebase.

05What this website stores in your browser

One cookie once you sign in, which holds that session. Two entries in local storage: your theme, and the fact that you read the storage notice. All three are necessary, none is shared, and none is used to profile you. The storage policy lists each one and lets you inspect and clear what is actually there.

06How your data is kept separate from other accounts

Tenant identity travels between services as call metadata and is never read out of a request body, so a client cannot assert whose data it is asking for. Every stored record is scoped to an account, and the data layer treats a missing tenant filter as an error rather than as a wildcard: a query that forgets to scope itself fails instead of returning everyone. A cross-tenant test corpus runs in CI on every push and fails the build if isolation breaks.

A record that is not yours is reported as not found. That is deliberate: an account should not be able to learn that something exists by being told it is forbidden.

The Security page describes each layer and what it enforces.

07How long it is kept

Content you create is kept until you delete it or close your account. Deleting a conversation, artifact, or knowledge entry removes it from the deployment; backups age out on the operator’s schedule, which is operatorbackup retention window.

The usage ledger is append-only and is retained for operatorledger retention period, typically set by tax and accounting law, because it is a billing record. It contains metered events and their cost, not message content.

08Your rights

Depending on where you live you may have the right to access your data, correct it, delete it, take it elsewhere in a portable form, object to particular processing, or complain to a regulator. Verity is built so these are ordinary operations rather than favours: everything in your account is scoped to your account and can be exported or removed.

To exercise any of them, contact operatorprivacy contact address. The operator responds within operatorresponse window, commonly 30 days. Your supervisory authority is operatorrelevant data protection authority.

One honest limit: content already sent to a model provider is subject to that provider’s retention, and deleting a conversation here does not reach into their systems.

09Security incidents

If a breach affects your data, the operator notifies affected accounts and, where the law requires it, the relevant authority. Report a suspected vulnerability to operatorsecurity contact address. Reports made in good faith will not be pursued.

10Changes

Material changes are announced in the changelog before they take effect, with the effective date above updated. A change that widens what leaves the deployment will always be called out explicitly rather than folded into a general update.