How VeroMass protects your data, your credentials, and your results — described precisely, so your IT and security teams can evaluate us properly.
Credentials for your LIMS or ELN endpoint are encrypted before they reach our database. Once saved they are never echoed back — not to the interface, not to an API response, not to support.
Every delivery is signed with HMAC-SHA256 over the delivery ID, the timestamp and the body as a single value. Signing the timestamp together with the payload — rather than the payload alone — is what actually prevents replay. Your endpoint can verify both authenticity and freshness.
Every endpoint URL you supply is validated against server-side request forgery when it is saved, and validated again at the moment of dispatch. A configuration edited between those two points cannot be used to reach internal infrastructure.
Deliveries are queued and retried with exponential backoff, so a brief outage on your side does not silently drop results. Every attempt is recorded with its status, and a failed delivery can be re-sent on demand.
Every integration must pass an explicit connection test before it delivers real data. Nothing runs unattended against your system of record until you have seen exactly what it will send.
The internal delivery endpoint is guarded by a shared secret rather than a user token and is not reachable from a tenant session. Dispatch infrastructure is separated from the API surface your users authenticate against.
VeroMass does not currently hold a SOC 2 report or ISO 27001 certification, and we will not imply otherwise. We would rather describe our architecture accurately and let your security team assess it than claim a certification we have not earned. If a formal audit is a requirement for your organisation, tell us — it helps us prioritise, and we will be straightforward about timing.
No. Your spectra, feature tables and results are processed to produce your identifications. They are not used to extend the reference collection or to train models.
Results are scoped to your account and to the organisation and project they belong to. Access is enforced on every request, not merely hidden in the interface.
On-premise and private-cloud deployment is available for institutional customers. If your data cannot leave your network, this is the path — talk to us about scope.
Contact us through the contact page. We will acknowledge, investigate and keep you informed. We do not pursue researchers who report in good faith.