Public control overview
Public controls cover RBAC, least privilege, tenant separation, encrypted transport, storage protection where applicable, incident response, credential handling and AI data handling.
SEGURANÇA E COMPLIANCE
Segurança enterprise-ready para mensagens com IA governada.
O Verbum foi desenvolvido para equipes que precisam de mensagens com IA, aprovação humana, auditabilidade, fluxos atentos à privacidade e controles de segurança documentados nos canais de negócio.
Materiais de segurança e compliance estão disponíveis para clientes qualificados e revisões de procurement.
SEGURANÇA E COMPLIANCE
Evidências de segurança para mensagens com IA governada.
O Verbum foi desenvolvido para equipes que precisam de fluxos de IA controlados, mensagens rastreáveis e evidências de segurança enterprise para revisões de procurement, jurídico e segurança.
Relatórios e evidências podem ser compartilhados com clientes qualificados durante revisão de segurança, sujeitos ao processo de confidencialidade apropriado.
Independent evidence
Trust Center is the source of truth for reports, certificates and testing references.
Security lists the public posture. Trust Center owns evidence names, status, evidence type, approved metadata and availability so sensitive materials are not duplicated across pages.
Evidence in Trust Center
SOC 2 Type II report
Evidence in Trust Center
ISO/IEC 27001:2022 evidence review
Evidence in Trust Center
LGPD + GDPR privacy program
Evidence in Trust Center
Application security controls aligned with OWASP ASVS
Evidence in Trust Center
Penetration testing review materials
Qualified review materials
Security review and procurement support.
Security and privacy review materials are available through qualified review.
Materiais disponíveis para revisão
- Questionários de fornecedores e respostas a RFP
- Revisão de Data Processing Agreement
- Revisão de subprocessadores
- Documentação de procurement
- Materiais de segurança e compliance para revisões qualificadas
Segurança do workflow
Como a segurança se conecta aos workflows do Verbum.
A segurança no Verbum acompanha a forma como as mensagens fluem: quem acessa o workspace, como aprovações são aplicadas, como a automação é limitada e como cada decisão fica registrada para revisão.
Controles do workflow
- Role-based access controls are designed to limit drafting, review, approval and administration to authorised workspace roles. Applies where enabled, within approved implementation scope, and during qualified review.
- Least-privilege access is applied to workspace roles, operational access and approved integration onboarding where applicable. Applies where enabled, within approved implementation scope, and during qualified review.
- Enabled workflow events can be recorded with available message, reviewer, rule, channel and timestamp context, subject to workspace configuration, plan capabilities and provider support. Applies where enabled, within approved implementation scope, and during qualified review.
- Channel, API and integration credentials are handled through protected setup, scoping, rotation or revocation practices where applicable. Applies where enabled, within approved implementation scope, and during qualified review.
Data protection controls
Data protection claims stay bounded by scope.
Security controls for tenant separation, transport protection, storage protection, retention and incident handling are described at a public level here. Detailed implementation evidence is handled through qualified security review.
Mapped data protection controls
- Workspace-scoped access patterns are designed to keep tenant data separated across messages, contacts, credentials and audit records. Applies where enabled, within approved implementation scope, and during qualified review.
- Browser and API connections are designed to use encrypted transport; protocol details can be reviewed during security evaluation. Applies where enabled, within approved implementation scope, and during qualified review.
- Encryption at rest is documented where applicable for platform storage and reviewed through qualified security materials. Applies where enabled, within approved implementation scope, and during qualified review.
- Verbum operates a documented incident response process for detection, containment and customer notification where applicable. Applies where enabled, within approved implementation scope, and during qualified review.
- Retention and deletion are reviewed through workspace configuration, plan policy, provider configuration, DPA, order form or written agreement. Applies where enabled, within approved implementation scope, and during qualified review.
Governança de IA
IA com governança, não uma caixa-preta.
Verbum Sense, Verbum Assist e Verbum Automate são projetados em torno de responsabilização. Humanos aprovam respostas sensíveis, regras configuradas limitam a automação e o histórico preserva o contexto para revisão.
Ver fluxos de aprovaçãoA IA rascunha e roteia mensagens dentro dos controles que sua equipe configura.
- AI context is designed to stay scoped to the active workspace conversation, configured policy context and selected channel metadata. Applies where enabled, within approved implementation scope, and during qualified review.
- Verbum Automate can act only when configured policy and guardrails match the message context. Applies where enabled, within approved implementation scope, and during qualified review.
- Customer operational data is not used for Verbum marketing.
- Verbum does not use customer business messages to train public AI models unless explicitly stated and contractually allowed.
- Customer message content is processed to provide configured AI-assisted drafting, routing, review and Verbum Automate workflows.
- Customer message content is not used to train public or general-purpose AI models unless explicitly stated and contractually allowed.
- Fine-tuning or training on customer message content requires explicit written authorization in the applicable agreement.
- AI subprocessors may process prompts, message context and outputs only to provide the configured service, subject to applicable provider terms and approved customer configuration.
- Retention of prompts, outputs and related workflow context follows the applicable workspace settings, plan terms, provider configuration, DPA, order form or written agreement.