Trust
Last updated 11 October 2026
VerGen holds the credentials of the systems you connect and the sessions your engineers record. This page says how that is protected, where it is held, and who else receives it. It names only what is in place today.
Certifications
- SOC 2 Type II: in progress. No report has been issued yet.
- ISO/IEC 27001: in progress. Not certified yet.
How your data is protected
- Every connection is encrypted with TLS, and browsers are told to use nothing else (HSTS).
- Credentials for the trackers, repositories and models you connect are encrypted with AES-256-GCM before they are stored. Disconnecting deletes them.
- Passwords are hashed with Argon2id. Sign-in sessions, password-reset links and machine tokens are stored only as hashes, so a copy of the database cannot be replayed as a login.
- Two-step verification by authenticator app or email, and an organisation can require it of every member.
- Every request is checked against the organisation and project it touches. A person sees only the projects they are on.
- Secrets and email addresses are removed from engineers' prompts on their machine before upload, and again when stored. Prompt text is deleted after 90 days.
- Tollgate, the command engineers install, updates only to releases signed with our key and checked against a published checksum.
- Card and bank details are entered on Paysera and never reach us.
- The database is backed up every night.
Where data is held
The service and its database run in the European Union. The sub-processors below say where each of them processes data. Where that is outside Kosovo and the European Economic Area, the transfer is covered by the provider's standard contractual clauses or an equivalent safeguard.
Sub-processors
| Sub-processor | What for | Data | Where |
|---|---|---|---|
| Hetzner Online GmbH | Hosts the servers, the database and its backups | All service data | European Union |
| Paysera LT, UAB | Takes payments | Payer name, email, payment details entered on Paysera | European Union |
| Resend | Delivers account, organisation and billing emails | Recipient name and email, email content | United States |
| Functional Software, Inc. (Sentry) | Console error reports and the feedback you choose to send | Error details, a recording with every word and input masked | European Union region |
| OpenRouter, Inc. | Reviews local session records when a project has assigned no model of its own | The session records it is asked to review | United States |
A model provider your project assigns in place of the default receives the same session records, under your organisation's own agreement with it.
The systems your organisation connects (trackers, help desks, repositories, chat workspaces) are your own vendors, not ours. VerGen exchanges data with them only on your instruction.
A change in who receives your data is announced to your organisation's administrators by email.
Reporting a vulnerability
Write to info@bezep.net with what you found and how to reproduce it. We confirm receipt, keep you informed while we fix it, and do not pursue anyone who reports in good faith and does not access or keep other people's data.
Who we are
VerGen is provided by Bezep Solutions Sh.p.k., registration number 811866732, registered at Pashko Vasa 12/1, Kosovo. Write to info@bezep.net about anything on this page.