Proven infrastructure. Built to pass your vendor review.
Verify is a first-party compliance and verification application on a hardened, open-source stack. It sits behind a security perimeter, keeps every provider key on the server, and runs the same way in our cloud, your cloud or your data center.
For your security reviewer
- SOC 2 Type II report under NDA
- Encrypted at rest and in transit (TLS 1.2+)
- SSO and MFA for administration
- Append-only audit trail
Four layers, from your users to the screening providers.
Requests travel left to right over HTTPS. Administration is fenced inside the application host, and the browser never holds a provider key.
API-first
Every action the interface performs is an authenticated REST call, made server-side. Custom endpoints are available on request.
Proven foundation
A hardened Linux, Apache, MySQL and PHP stack with two decades of backward compatibility and one of the deepest developer talent pools anywhere.
Deploy anywhere
Same application, same runtime. Azure, AWS, Google Cloud, private cloud or on-premises, with no proprietary managed service in the critical path.
Security posture
No public route to the application tier. Administration behind SSO and MFA. Encrypted at rest and in transit. Append-only audit trail.
Our cloud, your cloud or your data center.
XDuce-hosted
Managed by us
- PROD and DEV environments
- SOC 2 Type II controls
- Backups and disaster recovery by service level
- Upgrades and monitoring included
Your cloud
Azure, AWS or Google Cloud
- Runs inside your tenant
- Your data residency and keys
- We support within your change control
- Recovery under your own DR plan
On-premises
Your data center or private cloud
- Linux or Windows Server
- 8 vCPU · 32 GB · 500 GB+ SSD typical
- Same application and runtime
- Source code escrow available
Everything your security team will ask for.
Compliance or credit usually owns the business case, but IT and security can stop a deal. We plan for both from the first meeting and hand your reviewers a complete pack.
- SOC 2 Type II report, under NDA
- Architecture and data-flow diagrams
- Encryption, access and logging controls
- Service levels with RPO and RTO by tier
- Hosting and data residency options
- Master services agreement and security schedule
Service levels at a glance
Standard 99.5% · Enhanced 99.9% · Premium 99.9% · Mission Critical 99.95%. Recovery from 24 hours down to 15 minutes RPO and 1 hour RTO.
Compare service levelsStraight answers.
Is Verify SOC 2 compliant?
The XDuce-hosted Verify environment operates under SOC 2 Type II controls, and we share the report under NDA as part of your vendor security review.
Can Verify run in our own cloud tenant?
Yes. Verify runs in your Azure, AWS or Google Cloud tenant, a private cloud or on-premises. It's the same application and runtime everywhere, with no proprietary managed service in the critical path.
What server does Verify need?
A typical production server is 8 vCPU, 32 GB of memory and 500 GB or more of SSD storage, on Linux or Windows Server. We size each environment to your users, records and retention.
How is data protected?
Data is encrypted at rest and in transit with TLS 1.2 or higher. There is no public route to the application tier, administration sits behind single sign-on and MFA, and the audit trail is append-only.
What uptime does Verify offer?
It depends on the service level you choose: 99.5% for Standard, 99.9% for Enhanced and Premium, and 99.95% for Mission Critical. See service levels.