Security and data handling in detail

What is stored

• For each site: its topics and their questions, its competitors and their domains, its plays with their guides, checks and history, and its verdicts.
• For each poll answer: the engine, the question and its topic, the answer’s text, the pages it cited and read, the searches the engine ran, and the brands it names or cites.
• For each Engine Brief: the probes asked, the engine’s answers and the summary.
• For each run of the site audit: the URLs discovered, the sampled pages’ HTML as fetched by each identity, the extracted text and passages with their search index, the entities and claims, the simulation results, the findings and the analysis.
• Public third-party pages that answers cite: their readable text and the brands they name, kept version by version, because a page newly naming a brand is how an off-site play is dated. These are public pages, held once for the platform rather than per workspace, and they say nothing about who asked. The text of each version is deleted 24 months after Vercatus last read it; the address, title, kind and brands stay.

Retention

Vercatus retains fetched page bodies for 30 days and then deletes them; answers, briefs, plays, verdicts and reports are kept for the life of the site and deleted within 30 days of the workspace’s closure; a cited page’s text is deleted 24 months after Vercatus last read it; pooled figures identify no workspace and are kept; account data is kept until the account is deleted; server logs for at most 30 days. This is the one statement of retention; the privacy policy and the home page quote it.

Where

The application and the database run on servers in Amsterdam, Netherlands, so workspace data is stored in the EU. Fetched page bodies are kept in separate object storage for their 30 days. Analysis is sent to the model providers below, which are in the United States, under the EU-US Data Privacy Framework or the standard contractual clauses; the sub-processor list with each one’s location is in the privacy policy.

Shared answers and learning across workspaces

• Public questions. When two workspaces track exactly the same public question in the same market, the engine’s answer can be reused within six hours instead of asking again, and the shared copy is deleted within a day. The reused answer holds the engine’s answer only, never who asked, and brands are matched for each workspace separately. Private questions, which include every question taken from the site’s Search Console, are always asked live: their words go only to the engines asked, never into the shared answers or the repository. An admin can switch reuse off under Settings, General.
• Aggregates above privacy floors. Vercatus Intelligence pools frozen verdicts, natural experiments and demand calibration ratios across workspaces. What is pooled holds counts and effects, never a workspace, a site or a question, and nothing is shown or used until at least three sites contribute. See Vercatus Intelligence.
• Never pooled: your Analytics and Search Console data, your crawler-log data (only the calibration ratio computed from the logs), your notes, play statuses, drafts and private questions.

Tenancy

Every record carries the workspace it belongs to, and every request is scoped to the caller’s workspace. Behind that, the database enforces row-level security: the application connects with a role that can only see rows of the workspace set for the current request, so a query that ever missed its filter returns nothing rather than another workspace’s data. Two workspaces cannot see each other’s data. API keys are stored as hashes and shown once.

The one page that opens without a session is a read-only quarterly review, which an admin creates on purpose for a board: an unguessable link shown once and stored as a hash, a fixed window, an expiry the admin sets, revocation at any time, a record in the audit log, and a document that carries hosts and figures only, nothing that leads into the workspace. It is served with no-store and noindex headers.

Model providers

Analysis runs on our model provider under a no-training agreement; the provider is named in the sub-processor list. An Enterprise workspace can route its analysis through its own account instead (an Anthropic API key, Amazon Bedrock or Google Vertex AI): an admin sets it in the workspace, the credentials are stored encrypted and never shown again, and from then on the workspace’s model calls go to that provider, which is then not our sub-processor for the workspace. The poll keeps asking Claude itself, since it measures what that product answers to public questions. Page content from the customer’s verified domains is sent to a model; so is the public text of the third-party pages answers cite, to read the brands they name, the text of each poll answer, to read the brands it names, and, when Search Console is connected, the site’s buyer, problem and brand searches when its topics are built.

The crawler

A run’s page and file requests, the identity probes and the access watch are signed with a published key, so the signature is the identity rather than an address list (the rendered fetch, the icon fetch and a few small checks name Vercatus in the user agent and are unsigned; the reference lists them); analysis only of verified domains. Before verification a new workspace gets an access preview of its first domain (robots.txt first, and nothing else if it disallows Vercatus; then the home page, llms.txt and the sitemaps, in a few dozen requests, nothing analysed), the setup wizard checks a typed domain the same way, and the app reads the home page and icon of the hosts it shows, at most once a month per host, for the icon beside a name. robots.txt is honoured by runs and by the preview and the checks; the icon fetch does not consult it. See The crawler.

What is not yet in place

Vercatus does not yet hold a SOC 2 attestation and does not yet offer a choice of data region per workspace (data is stored in the EU for everyone; EU-only analysis is not yet available); both are on the roadmap and are stated as such in contracts until they ship. Everything else on this page is in place today.

The documents

Privacy policy, Terms of service and the Data processing agreement, which applies to every workspace and lists the sub-processors with their locations. Security on the main site is the reviewer’s summary of this page with every control and its state.