Security
Found a security problem in Verity? Email Jacob@getverity.report with the subject “Security report”. A person reads every one.
What to include
The page or route involved, the steps to reproduce it, and what you were able to see or do. A screenshot or short recording helps. Please do not include other people’s conversations or personal data in the report.
What to expect
We aim to acknowledge a report within three business days and to tell you what we found. Our targets for a fix are 7 days for a high-severity problem, 30 days for medium and 90 days for low, counted from when we confirm it.
Testing in good faith
Please test only against your own account and your own data, do not use automated scanners that degrade the site for others, and give us a reasonable chance to fix a problem before making it public. We will not take action against anyone who reports a problem in good faith and follows these rules. Verity does not run a paid bug bounty.
How Verity handles conversations
A conversation file you open is read and analyzed in your browser; the file itself is not uploaded. In the attorney portal, a finished report, which quotes the flagged messages, is saved to the firm’s account so it can be reopened. Account data is stored with row-level access rules so that one firm cannot read another firm’s records, and payments are handled by Stripe.
For how personal data is collected and used, see the privacy policy. For anything that is not a security problem, use support.