TRUST CENTER

統制されたAIメッセージングのためのセキュリティ、プライバシー、コンプライアンス証跡。

ビジネスメッセージングチャネルでAIを利用するチーム向けに、Verbumのセキュリティ体制、プライバシーへの取り組み、コンプライアンス証跡、調達リソースを確認できます。

SOC 2 Type II report: qualified review ISO/IEC 27001:2022 evidence review: qualified review LGPD + GDPR privacy program: qualified review Application security controls aligned with OWASP ASVS: qualified review Penetration testing review materials: qualified review

Request Security Package View Evidence Matrix

TRUST CENTER AREAS

Security, privacy, compliance and vendor review in one place.

Start with the area your evaluator needs, then use the matrix below to confirm status, scope, issuer and availability.

Public overview plus qualified security package.

Security controls

Public control overview, mapped security control documentation and protected implementation detail for qualified review.

Review area Public documentation plus qualified legal/privacy review.

Privacy and DPA

Review area Public disclosure plus qualified review.

Subprocessors

Public provider disclosure plus protected provider-category and deployment-specific details for qualified review.

Review area Qualified review material; NDA may apply.

Compliance evidence

Qualified-review material for certificates, reports, control mappings or testing evidence when issuer, dates and scope are approved.

Review area Available through qualified procurement review.

Procurement support

Questionnaire support, RFP responses, security package routing, DPA context and deployment-specific follow-up.

Review area Public policy.

Security disclosure

Responsible disclosure policy, permitted reporting path, safe-harbor expectations and prohibited testing boundaries.

Review area

TRUST RESOURCE MATRIX

Public documents, control descriptions and review paths.

Resources are grouped by type so Verbum-owned policies, control descriptions, qualified-review packages and independent evidence are not treated as the same thing.

Independent and qualified-review evidence

Qualified review material

SOC 2 Type II report

Status: Qualified review material
Evidence type: SOC 2 Type II report
Owner: Security / Compliance
Availability: Available to qualified customers during security review, subject to NDA or an appropriate confidentiality process.
Confidentiality: Subject to NDA or an appropriate confidentiality process.

Request review

Qualified review material

ISO/IEC 27001:2022 evidence review

Information security management evidence

Status: Qualified review material
Evidence type: Information security management evidence
Owner: Security / Compliance
Availability: Available to qualified customers during security review, subject to NDA or an appropriate confidentiality process.
Confidentiality: Subject to NDA or an appropriate confidentiality process.

Request review

Qualified review material

LGPD + GDPR privacy program

Privacy program and processing documentation

Status: Qualified review material
Evidence type: Privacy program and processing documentation
Owner: Privacy / Legal
Availability: Available through qualified privacy or legal review.

Request review

Qualified review material

Application security controls aligned with OWASP ASVS

Application security control alignment

Status: Qualified review material
Evidence type: Application security control alignment
Owner: Security / Compliance
Availability: Available to qualified customers during security review, subject to NDA or an appropriate confidentiality process.
Confidentiality: Subject to NDA or an appropriate confidentiality process.

Request review

Qualified review material

Penetration testing review materials

Protected penetration testing review material

Status: Qualified review material
Evidence type: Protected penetration testing review material
Owner: Security / Compliance
Availability: Available to qualified customers during security review, subject to NDA or an appropriate confidentiality process.
Confidentiality: Subject to NDA or an appropriate confidentiality process.

Request review

Security and privacy review materials are available through qualified review.

Evidence MatrixSecurity, privacy, subprocessors, compliance, procurement and disclosure materials mapped by coverage, availability, review path and confidentiality.
Evidence area	What it covers	Availability	Review Path	NDA Required	Related document
Security controls	Access control, tenant separation, encrypted transport, storage protection where applicable and credential handling.	Qualified review; confidentiality process may apply.	Request Security Package	May apply for detailed control materials.	Security overview
Privacy and DPA	Privacy Policy, Data Processing Overview, retention matrix, deletion review and AI training policy.	Public overview plus qualified legal/privacy review.	Request DPA Review	Not required for public pages; legal review may use a confidentiality process.	Data Processing Overview
Subprocessors	Public provider disclosure, provider categories available during qualified review and deployment-specific provider context.	Public page; additional provider details through qualified review.	View Subprocessors	May apply for protected provider or deployment-specific details.	Subprocessors
Compliance evidence	SOC 2 Type II report, ISO/IEC 27001:2022 evidence review, LGPD + GDPR privacy program, Application security controls aligned with OWASP ASVS, Penetration testing review materials	Qualified review material. Certificates, reports or independent assessments are referenced only when issuer, dates and scope are approved for disclosure.	Request Security Package	NDA or an appropriate confidentiality process may apply.	Security overview
Procurement support	Security questionnaires, RFP responses, procurement follow-up, DPA context and deployment-specific review.	Available through qualified procurement review.	Contact Procurement	May apply depending on requested materials.	Legal Center
Security disclosure	Vulnerability reporting scope, safe-harbor expectations, prohibited testing and security contact path.	Public policy.	Review Security Disclosure	No NDA required for the public disclosure policy.	Security Disclosure

Security and compliance evidence source of truth

Current evidence available

Security control documentation

control description

Status: Current evidence available
Evidence type: control description
Issuer / auditor: Verbum security/privacy review team
Owner: Product Security / Engineering
Period / date: Reviewed during qualified security or procurement review.
Scope: Access control, tenant separation, encrypted transport, storage protection where applicable and credential handling.
Availability: Qualified review; confidentiality process may apply.
Confidentiality: Subject to NDA or an appropriate confidentiality process.

Request review

Current evidence available

Audit history controls

control description

Status: Current evidence available
Evidence type: control description
Issuer / auditor: Verbum
Owner: Product Security / Product Engineering
Scope: Enabled workflow events, approval decisions, configured rules and supported channel context.
Availability: Public overview; implementation details through qualified review.

Request review

Current evidence available

Incident response materials

qualified-review package

Status: Current evidence available
Evidence type: qualified-review package
Issuer / auditor: Verbum security/privacy review team
Owner: Security / Operations
Period / date: Reviewed during qualified security or procurement review.
Scope: Security reports, vulnerability intake, incident triage and customer notification where applicable.
Availability: Qualified review; confidentiality process may apply.
Confidentiality: Subject to NDA or an appropriate confidentiality process.

Request review

Current evidence available

Privacy, DPA and retention documentation

public policy

Status: Current evidence available
Evidence type: public policy
Issuer / auditor: Verbum
Owner: Privacy / Legal
Scope: Privacy Policy, Data Processing Overview, retention matrix, deletion review and AI training policy.
Availability: Public overview plus qualified legal/privacy review.

Request review

Current evidence available

AI data handling controls

control description

Status: Current evidence available
Evidence type: control description
Issuer / auditor: Verbum
Owner: Product Security / AI Product Engineering
Scope: Prompt context, AI training policy, configured workflow context, provider configuration and retention references.
Availability: Public summary; implementation details through qualified review.

Request review

Trust resource source of truth

Public legal/privacy documents

Terms of Service

public policy

Public terms for subscriptions, platform use, customer content and governance responsibilities.

Status: Public
Produced by: Verbum
Scope: Public service terms, acceptable use, customer responsibilities and legal review path.
Availability: Public.
Confidentiality: Public or no NDA required for the public resource.

Open resource

Privacy Policy

public policy

Public privacy policy describing how Verbum collects, uses and protects personal data.

Status: Public
Produced by: Verbum
Scope: Website, account, support, security and product privacy context.
Availability: Public.
Confidentiality: Public or no NDA required for the public resource.

Open resource

Cookie Policy

public policy

Public cookie and browser storage inventory with consent-control context.

Status: Public
Produced by: Verbum
Scope: Website cookies, browser storage, consent controls and currently configured analytics behavior.
Availability: Public.
Confidentiality: Public or no NDA required for the public resource.

Open resource

Data Processing Overview

public policy

Public overview. It does not replace the signed DPA.

Status: Public
Produced by: Verbum
Scope: Public summary of processing roles, processing activities, subprocessors, safeguards and DPA review request path.
Availability: Public overview; DPA review request path through qualified legal review.
Confidentiality: Public or no NDA required for the public resource.

Open resource

Subprocessors

public policy

Public subprocessor disclosure and qualified review path for protected provider details.

Status: Public
Produced by: Verbum
Scope: Public provider disclosure and provider categories available during qualified review.
Availability: Public page; additional provider details through qualified review.
Confidentiality: Public or no NDA required for the public resource.

Open resource

Public security resources

Security overview

control description

Public control overview. Evidence status and sensitive materials remain handled through qualified review.

Status: Public
Produced by: Verbum
Scope: Public description of technical and operational controls for governed AI messaging.
Availability: Public.
Confidentiality: Public or no NDA required for the public resource.

Open resource

Security Disclosure

public policy

Public responsible disclosure policy for vulnerability reports.

Status: Public
Produced by: Verbum
Scope: Vulnerability reporting scope, safe-harbor expectations, prohibited testing and security contact path.
Availability: Public.
Confidentiality: Public or no NDA required for the public resource.

Open resource

Control documentation

Security control documentation

control description

Control documentation can be shared with qualified reviewers without exposing sensitive implementation details publicly.

Status: Qualified review material
Produced by: Verbum security/privacy review team
Review / expiration: Reviewed during qualified security or procurement review.
Scope: Mapped controls for access, tenant separation, encryption, credential handling, incident response and AI governance.
Availability: Qualified review; confidentiality process may apply.
Confidentiality: Confidentiality process may apply.

Open resource

AI data handling controls

control description

Public AI data handling summary aligned with Security, Privacy, Terms and Data Processing Overview.

Status: Public
Produced by: Verbum
Scope: Prompt context, AI training policy, configured workflow context, provider configuration and retention references.
Availability: Public summary; implementation details through qualified review.
Confidentiality: Public or no NDA required for the public resource.

Open resource

Qualified-review materials

Security and privacy review package

qualified-review package

Security and privacy review materials available for qualified review.

Status: Qualified review material
Produced by: Verbum security/privacy review team
Review / expiration: Reviewed during the qualified review process.
Scope: Security, privacy, legal and procurement materials shared according to approved review scope.
Availability: Qualified review; NDA may apply.
Confidentiality: Confidentiality process may apply.

Request review

Vendor questionnaire support

qualified-review package

Questionnaire support can be provided during qualified enterprise review.

Status: Qualified review material
Produced by: Verbum security/privacy review team
Review / expiration: Reviewed per qualified customer request.
Scope: Security questionnaires, RFP responses and procurement follow-up for qualified evaluations.
Availability: Qualified review.
Confidentiality: Public or no NDA required for the public resource.

Request review

Protected evidence materials

qualified-review package

Available to qualified customers during security review, subject to NDA or an appropriate confidentiality process.

Status: Qualified review material
Produced by: Verbum security/privacy review team
Review / expiration: Reviewed during the qualified review process.
Scope: Sensitive reports, testing materials, control mappings and deployment-specific details when approved for the review scope.
Availability: Qualified review; NDA may apply.
Confidentiality: Confidentiality process may apply.

Request review

Request Security Package Request DPA Review View Subprocessors Contact Procurement

エンタープライズレビュー

チームに必要なセキュリティと調達のコンテキストを入手してください。

セキュリティパッケージを依頼セキュリティ概要を見る