Security
Where Verus runs, and what that does and does not mean
Verus runs on Oracle Cloud in London, with live standby copies on IONOS in Germany and London. Those providers hold certifications for their infrastructure, and under the shared responsibility model those cover the half of the system they operate. This page is about which half is which.
Security and procurement review
- What assurance is in place today?
- Verus stores its data on Oracle Cloud in the United Kingdom, copied continuously to IONOS in Germany and London, on infrastructure covered by those providers’ certifications, which are listed below. Messages are encrypted on the device before they reach us, so no sub processor ever handles readable content.
- Do you meet UK GDPR?
- Yes. The data controller is Verus Communications Ltd, company number 17429651. Our privacy policy sets out what we hold, why we hold it and how long we keep it.
- Where does the data sit?
- Stored data sits on Oracle Cloud in London, with live copies on IONOS in Stuttgart, Germany, and in London. Until 2 October 2026 it sat on Amazon Web Services in Sweden. Calls pass, encrypted and unstored, through a relay near the caller as the normal route; the regions are listed on the sub-processors page. Messages are encrypted on the device before they reach us, so no sub processor ever handles readable content.
- What can I check for myself?
- Ask the live service what it cannot store. It works the answer out from its own database when you call it, and you do not need an account: api.verusapp.co.uk/v1/deployment.
- Can I see the providers’ reports?
- Oracle publishes its certificates and attestations on its cloud compliance pages, linked below; some reports are released only under Oracle’s own terms. We can help you obtain them, and IONOS’s certificates, for your review. Email hello@verusapp.co.uk.
- Our process needs more than this. What now?
- Tell us what it requires and we will work to it. An independent audit of our own half is on the roadmap, and we would rather scope it against a real requirement than guess at one. Email hello@verusapp.co.uk.
What our providers certify
The infrastructure Verus runs on is covered by its providers’ own audited certifications. These are Oracle’s and IONOS’s, awarded to them, and they attest to how they run data centres, hypervisors and networks.
| Programme | What it covers |
|---|---|
| ISO 27001 (Oracle Cloud and IONOS) | Each provider's information security management system for its own infrastructure. |
| ISO 27017 (Oracle Cloud) | Security controls specific to cloud services, at the infrastructure layer. |
| ISO 27018 (Oracle Cloud) | Handling of personal data in the cloud, as a processor. |
| ISO 27701 (Oracle Cloud) | Privacy information management, extending ISO 27001. |
| SOC 1, SOC 2 and SOC 3 (Oracle Cloud) | Independent reports on Oracle's controls, renewed on a cycle. |
| CSA STAR (Oracle Cloud) | Cloud Security Alliance registry entry for the platform. |
| C5 (Oracle Cloud) | Germany's cloud computing compliance criteria catalogue. |
Oracle publishes its full list at oracle.com/corporate/cloud-compliance, and it is longer than this. The rows above are the ones that bear on a service like this one. The call relays abroad run on Vultr and Amazon Web Services and carry only encrypted calls, which they do not store.
The line between them
Every cloud provider puts it the same way: their certifications are assessed by an independent auditor and result in a certification for the provider, and customers remain responsible for complying with the laws, regulations and privacy programmes that apply to them. The provider secures the infrastructure. What is built on it is ours.
So a badge on this page saying ISO 27001 would be a provider’s badge worn by somebody else. What follows is our half.
What Verus does with its half
Each of these is checkable rather than asserted, which is the point of the design and the reason the schema is public.
| Control | How it is done |
|---|---|
| Messages are unreadable to us | Encrypted on the sending device and opened on the receiving one. The server stores bytes it holds no key for. |
| No record of who talked to whom | A stored message carries who it is for and has no sender column at all, which is a fact about the table rather than a policy. |
| No personal data collected | There is no name, phone number or email column. An account is a public key and three dates. |
| Timestamps are coarse | Account activity is recorded as a date, never a time, so a copy of the database cannot show when somebody was awake. |
| Data is deleted, not archived | Messages go on delivery or after 30 days, attachments after 7, and an unused address burns after 30. |
| Encrypted in transit and at rest | TLS to the service, and the stored payload is ciphertext regardless of the disk it sits on. |
| Hosted in the United Kingdom, with standbys | The service runs in London and is copied continuously to Germany and a second London site, either of which can take over. This page changes if that changes. |
| No analytics, no advertising, no trackers | None in the apps and none on this site, so no request from a reader reaches anybody but us. |
| Deletion is immediate and complete | Deleting an account removes the address, the keys, the queue and any claim, with no retention window. |
Data protection
The data controller is Verus Communications Ltd, company number 17429651, and the UK GDPR and the Data Protection Act 2018 apply. What is held, why, and for how long is set out in full in the privacy policy, as a table rather than a paragraph.
There are no sub processors handling message content, because there is no readable message content to hand anybody. Translation runs on the device. Attachments are encrypted before they are uploaded. The only third parties in the path are Oracle and IONOS, who host the encrypted store and its standby copies, Confrmo when somebody chooses to verify, and the push services that wake the app so a new message reaches the lock screen while Verus is closed: Apple's on iPhone and Mac, Google's Firebase Cloud Messaging on Android. The wake is empty: no sender, no preview and no content. The message is fetched and opened on the device.
Intellectual property
Fifteen United Kingdom patent applications cover mechanisms in this service, and they are one family. The first is the attestation described above: the list of things this deployment cannot hold, worked out from its own database when you ask for it. The other fourteen carry the same idea into the rest of the service, so that metering a call, negotiating with a server, enforcing the list, taking an abuse report, charging for a raised limit and knowing the phone is still in the right hands each work without the record they would normally need.
Every one of them is on the patents page, with its number, its title as filed and its applicant. They are applications and none of them is granted.
The software itself is a separate matter, and a separate kind of claim. Copyright in it arose when it was written, without anybody applying for anything; what a registration adds is third party evidence of that, dated and lodged at the time rather than asserted by us afterwards.
What you can check for yourself
Certification is a statement that somebody else checked. For a service whose central claim is that it holds nothing worth taking, the stronger evidence is that you can look: the schema is published, the endpoint that describes it answers anybody, and the absence of a sender column is a fact about a table rather than a promise in a policy.
An independent audit of our own half is on the roadmap, and this page will name it when it exists. If your assurance process needs something specific before then, tell us what it is and we will work to it.