Public control overview
Public controls cover RBAC, least privilege, tenant separation, encrypted transport, storage protection where applicable, incident response, credential handling and AI data handling.
セキュリティとコンプライアンス
ガバナンスされたAIメッセージングのためのエンタープライズ対応セキュリティ。
Verbumは、AI支援メッセージング、人による承認、監査可能性、プライバシーを意識したワークフロー、文書化されたセキュリティコントロールを必要とするチーム向けに構築されています。
セキュリティおよびコンプライアンス資料は、対象となる顧客および調達レビュー向けに提供できます。
セキュリティとコンプライアンス
ガバナンスされたAIメッセージングのためのセキュリティ証跡。
Verbumは、調達、法務、セキュリティレビューで管理されたAIワークフロー、追跡可能なメッセージング、エンタープライズ向けのセキュリティ証跡を必要とするチーム向けに構築されています。
レポートや証跡は、適切な機密保持プロセスに基づき、対象となるお客様のセキュリティレビュー時に共有できます。
Independent evidence
Trust Center is the source of truth for reports, certificates and testing references.
Security lists the public posture. Trust Center owns evidence names, status, evidence type, approved metadata and availability so sensitive materials are not duplicated across pages.
Evidence in Trust Center
SOC 2 Type II report
Evidence in Trust Center
ISO/IEC 27001:2022 evidence review
Evidence in Trust Center
LGPD + GDPR privacy program
Evidence in Trust Center
Application security controls aligned with OWASP ASVS
Evidence in Trust Center
Penetration testing review materials
Qualified review materials
Security review and procurement support.
Security and privacy review materials are available through qualified review.
レビュー可能な資料
- ベンダー質問票とRFP回答
- Data Processing Agreementレビュー
- サブプロセッサーレビュー
- 調達文書
- 対象レビュー向けのセキュリティおよびコンプライアンス資料
ワークフローセキュリティ
Verbumのワークフローにセキュリティがどう対応するか。
Verbumのセキュリティは、メッセージの流れに紐づいています。誰がワークスペースにアクセスできるか、承認がどう適用されるか、自動化がどう制約されるか、各判断がレビューのためにどう記録されるかを扱います。
ワークフローコントロール
- Role-based access controls are designed to limit drafting, review, approval and administration to authorised workspace roles. Applies where enabled, within approved implementation scope, and during qualified review.
- Least-privilege access is applied to workspace roles, operational access and approved integration onboarding where applicable. Applies where enabled, within approved implementation scope, and during qualified review.
- Enabled workflow events can be recorded with available message, reviewer, rule, channel and timestamp context, subject to workspace configuration, plan capabilities and provider support. Applies where enabled, within approved implementation scope, and during qualified review.
- Channel, API and integration credentials are handled through protected setup, scoping, rotation or revocation practices where applicable. Applies where enabled, within approved implementation scope, and during qualified review.
Data protection controls
Data protection claims stay bounded by scope.
Security controls for tenant separation, transport protection, storage protection, retention and incident handling are described at a public level here. Detailed implementation evidence is handled through qualified security review.
Mapped data protection controls
- Workspace-scoped access patterns are designed to keep tenant data separated across messages, contacts, credentials and audit records. Applies where enabled, within approved implementation scope, and during qualified review.
- Browser and API connections are designed to use encrypted transport; protocol details can be reviewed during security evaluation. Applies where enabled, within approved implementation scope, and during qualified review.
- Encryption at rest is documented where applicable for platform storage and reviewed through qualified security materials. Applies where enabled, within approved implementation scope, and during qualified review.
- Verbum operates a documented incident response process for detection, containment and customer notification where applicable. Applies where enabled, within approved implementation scope, and during qualified review.
- Retention and deletion are reviewed through workspace configuration, plan policy, provider configuration, DPA, order form or written agreement. Applies where enabled, within approved implementation scope, and during qualified review.
AIガバナンス
ブラックボックスではない、ガバナンスされたAI。
Verbum AssistとVerbum Automateは説明責任を中心に設計されています。人が機微な返信を承認し、設定されたルールが自動化を制限し、履歴がレビューに必要な文脈を保持します。
承認ワークフローを見るAIは、チームが設定したコントロール内でメッセージを下書きし、ルーティングします。
- AI context is designed to stay scoped to the active workspace conversation, configured policy context and selected channel metadata. Applies where enabled, within approved implementation scope, and during qualified review.
- Verbum Automate can act only when configured policy and guardrails match the message context. Applies where enabled, within approved implementation scope, and during qualified review.
- Customer operational data is not used for Verbum marketing.
- Verbum does not use customer business messages to train public AI models unless explicitly stated and contractually allowed.
- Customer message content is processed to provide configured AI-assisted drafting, routing, review and Verbum Automate workflows.
- Customer message content is not used to train public or general-purpose AI models unless explicitly stated and contractually allowed.
- Fine-tuning or training on customer message content requires explicit written authorization in the applicable agreement.
- AI subprocessors may process prompts, message context and outputs only to provide the configured service, subject to applicable provider terms and approved customer configuration.
- Retention of prompts, outputs and related workflow context follows the applicable workspace settings, plan terms, provider configuration, DPA, order form or written agreement.