Security

Verdo stores your team's decisions. Here is exactly how that data is protected. This is a summary; a full security page follows in a later release.

Data location

All data is stored in the United States — Supabase on AWS us-east-1 (Northern Virginia). We do not currently offer regional hosting; contact us before installing if you need it.

Encryption at rest

All Slack and integration tokens are encrypted with AES-256-GCM, using a key that is never stored alongside the data.

Encryption in transit

TLS 1.2 or higher everywhere — every request to Verdo and between Verdo and its providers.

Participant tokens

Voter tokens are SHA-256 hashed and never stored in plaintext. Anonymous votes are recorded but cannot be de-anonymized.

Audit log

Every create, vote, decide, transition, and export writes an append-only audit row with actor and timestamp. Nothing is silently modified.

Authentication

Slack OAuth is the primary sign-in, backed by Supabase Auth. Verdo only holds the Slack scopes you approve at install.

AI features

"Suggest options" sends only the decision title to Anthropic's API, cached 24 hours via Upstash. No vote, participant, or workspace data leaves Verdo, and nothing is used for training.

Certifications

Verdo does not hold SOC 2 or ISO 27001 today; both are planned for a future plan.

Security questions: contact@aethondigital.net (subject line "Security Inquiry") · Aethon Digital FZCO, Dubai, UAE.