Security Overview

At Veriti, customer trust is fundamental to our product design. Security and privacy are considered throughout the software development lifecycle rather than being added after development. We apply the principle of least privilege, minimise data collection wherever possible, and continuously improve our security posture based on evolving threats and customer feedback.

For our broader product principles and customer commitments, see Our Principles.

Security considerations are incorporated throughout product design, implementation, testing and deployment. New functionality is reviewed for security implications before release.

Security vulnerabilities can be reported confidentially to operations@codeweave.io with the subject line “Security vulnerability”. We ask researchers not to publicly disclose issues until we have had a reasonable opportunity to investigate and remediate.

Users authenticate with credentials managed through the platform identity layer. Successful login establishes a validated session that must be presented for protected API requests.

• Authentication process: Credentials are verified server-side before a session is issued.
• Password protection: Passwords are hashed with modern one-way algorithms and never stored in plaintext.
• Session validation: Protected routes validate session integrity before returning school data.

Veriti uses role-based access control (RBAC). Each user is assigned a role within their school tenancy. Roles determine which modules and actions are available. Permission checks are enforced on the server for every sensitive operation.

• Server-side validation: Requests are validated on the server before data is read or written.
• Permission enforcement: Authorisation is checked for protected resources, not only in the UI.
• Input validation: Payloads are checked for required fields, formats and length limits.
• Rate limiting: Applied on public contact endpoints and selected sensitive routes. Broader API rate limiting continues to expand.

• Logging: Application and platform logs support troubleshooting and incident investigation.
• Monitoring: Hosting and health monitoring help detect outages and degraded performance.
• Security updates: Dependencies and platform components are updated on a recurring basis.
• Incident response: Material incidents are triaged, mitigated and communicated to affected schools. Formal playbooks continue to mature.

Where customer data may be materially affected by a security incident, Veriti follows documented incident response procedures and communicates with affected customers as appropriate.