VERANeural Trust Center
Security, privacy and responsible operation.
One place for how VERANeural approaches website security, reporting, privacy and production readiness for VERA.
What this covers
A practical trust layer for the public site.
This page is for prospects, partners and reviewers who want a clear view of the controls, reporting paths and operating principles around veraneural.com.
Encrypted in transit and at rest
Traffic is served over HTTPS/TLS, and the site is configured with HSTS and hardened browser security headers. Sensitive service credentials stay in managed environment configuration, not in the repository.
Approval before action
VERA is designed around explicit approval for actions that send, change or delete. The public site reflects that model and keeps business logic behind server routes rather than client-side secrets.
Operational visibility
The site includes documented security reporting paths, defensive API handling and deployment-friendly cache and security headers to support safe production operations.
Security reporting
Found a vulnerability or risky behaviour?
Please report it privately so we can investigate and fix it quickly.
- Use the contact form and choose a security-related topic
- Email support@veraneural.com if the form is unavailable
- Include steps to reproduce, affected URLs and screenshots if helpful
- Do not test against other users' data or production accounts you do not control
Current website hardening
- Security headers including HSTS and Content-Security-Policy
- No-store caching on API routes
- Immutable caching for static assets
- Signed webhook verification on billing endpoints
- Graceful failure when email or billing config is missing
Operating commitments
What we should keep true at launch.
Public trust is not just design. It depends on claims, controls and customer experience staying aligned.
- Privacy, security and safety claims should match what is operationally true today.
- We do not expose secrets in the client or repository.
- Security-sensitive routes fail closed when required configuration is missing.
- Vulnerability reports should be sent privately and handled promptly.