Introduction

At Youverify, we are committed to protecting the confidentiality, integrity, and availability of all information we handle. We recognize that information security is essential to maintaining the trust of our users, clients, and partners, as well as meeting legal, regulatory, and industry obligations.

This policy reflects our responsibility to safeguard the privacy and security of data entrusted to us. It provides a structured framework to prevent unauthorized access, disclosure, alteration, or destruction of information, while fostering a culture of security awareness, accountability, and continuous improvement throughout the organization.

Information Security Objectives

We maintain a Security-first approach to protect data under our custody, guided by clear and measurable objectives. Our primary focus is to ensure the confidentiality, integrity, and availability of data handled by YouVerify. We are committed to complying with globally recognized standards and frameworks, including ISO/IEC 27001 and 27018, as well as international and local data protection regulations such as the GDPR, NDPA, POPIA, the UK Data Protection Act 2018, the Kenya Data Protection Act, and other applicable frameworks.

Our goal is to establish and sustain a secure environment for the storage, processing, and transmission of sensitive and personal data. We take proactive measures to prevent unauthorized access, modification, disclosure, or destruction of information, while also fostering a culture of security awareness and best practices among employees, contractors, and external partners.

Applicability

This Policy applies to information collected through our websites, including all pages and services under the Youverify.co domain and its subdomains, as well as through email, text, APIs, web services, and other electronic communications exchanged between you and our website. It covers all systems, infrastructure, applications, and devices used for storing, transmitting, or processing data, as well as both physical and logical security controls to safeguard sensitive information across the organization. This Policy also applies to all AI systems developed, provided, or used by Youverify, including AI models, training data, and AI-specific infrastructure.

However, this Policy does not apply to information collected by Youverify through offline channels or other means, including websites operated by third parties such as our affiliates or subsidiaries. It also does not cover information collected by any third party through applications, content, or advertisements that may link to or be accessible from our website.

Information Security Governance

At Youverify, our Information Security Governance framework ensures that our security practices are aligned with organizational goals, regulatory requirements, and customer expectations. We foster a culture of accountability, transparency, and continuous improvement across all departments.

Our program is led by the Information Security Officer (ISO), in close collaboration with the Data Protection Officer (DPO), who oversees data privacy compliance to ensure that personal data is processed lawfully and securely. Together, they manage our Information Security Management System (ISMS), which is built on internationally recognized standards such as ISO/IEC 27001. This system governs the development and enforcement of policies, procedures, and controls that safeguard our information assets from both internal and external threats.

Information Security Measures

At youverify, we employ a combination of administrative, physical, technical, and organizational security measures to protect user information from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. These measures are designed based on the sensitivity of the information and are continuously reviewed to address evolving risks.

Access Management: Our access control follows the principle of least privilege, granting employees access only to the data required for their job. We regularly review access levels and promptly revoke access during role changes or employee departures. Sensitive areas are secured with badge access, biometric authentication, and surveillance cameras, while only authorized personnel can access critical infrastructure. We use role-based access control (RBAC) and multi-factor authentication (MFA) to ensure secure access to systems. Access to AI model registries, training pipelines, and production model APIs is restricted to authorized personnel with documented business justification.
Incident Response Plan: Youverify maintains a well-documented and actionable incident response plan designed to address security incidents. The plan includes clear procedures for containing the incident, communicating with stakeholders, and investigating the cause. We perform regular testing and simulation exercises to ensure readiness, and the plan is updated annually to keep it aligned with emerging threats and best practices. The incident response plan includes AI-specific incident types: model drift exceeding defined thresholds, emergence of bias above acceptable levels, data poisoning, model theft, adversarial attacks, and unauthorized access to AI systems.
Business Continuity & Disaster Recovery: To minimize operational downtime during disruptions, Youverify has implemented comprehensive business continuity and disaster recovery plans. These plans ensure that critical systems and data can be restored quickly after an incident. We also conduct regular recovery drills to verify the effectiveness of these plans, with specific recovery time objectives (RTO) and recovery point objectives (RPO) to measure the recovery efficiency. AI system dependencies are included in BCP/DR planning, with rollback procedures allowing reversion to previous model versions within defined timeframes.
Disciplinary Action: Our security policies include clear guidelines on the consequences of violating data protection policies. These disciplinary actions ensure accountability and adherence to our data security protocols.
Security Awareness Training: We prioritize the education of our employees regarding security threats and the importance of safeguarding sensitive information. Quarterly security awareness training helps employees recognize common threats, such as phishing or social engineering tactics, and ensures they understand best practices for handling and sharing data securely. Personnel involved in AI development and operations receives additional training on AI-specific threats, including data poisoning, model stealing, adversarial attacks, and prompt injection.
Regular Security Audits & Risk Assessments: We proactively assess the effectiveness of our security measures through bi-annual internal audits and risk assessments, along with an annual external audit. These reviews help identify vulnerabilities, which are addressed before they can be exploited. Additionally, we evaluate compliance with relevant regulations and industry standards, ensuring our practices remain up to date. AI systems are included in the scope of all security audits and risk assessments, with specific attention to AI-specific threats and controls.
Environmental Controls: Our data centers are equipped with advanced environmental controls that maintain optimal conditions for hardware. Temperature and humidity levels are monitored continuously to prevent overheating or damage. Additionally, backup power supplies and redundant systems ensure our services remain uninterrupted in the event of power outages.
Fire Suppression Systems: To protect both our infrastructure and data, our data centers are equipped with fire suppression systems that quickly detect and suppress fires. These systems include automated sprinklers, gas-based fire suppression, and smoke detection systems to minimize risks in case of a fire.
Data Encryption: We use encryption to protect sensitive data both in transit and at rest. For data in transit, we use TLS 1.2 or higher, ensuring secure communication across networks. For data at rest, we use AES-256 encryption, a strong industry-standard algorithm that keeps data secure when stored on our systems.
Malicious Activity Prevention: We employ advanced firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) to continuously monitor network traffic, detect malicious activity, and block potential threats before they can compromise our systems. IDS/IPS rules are configured to detect adversarial input patterns and potential data poisoning attempts targeting AI systems.
Vulnerability Management and Testing: To maintain ongoing security, we conduct vulnerability testing on a quarterly basis. These regular assessments help identify weaknesses in our systems, enabling us to fix any security gaps and enhance our protection measures proactively.
Secure Software Development Practices: Security is a key component of our software development lifecycle. We follow secure coding practices to prevent vulnerabilities, such as SQL injection and cross-site scripting (XSS). AI models are subject to the same secure development controls as conventional software, including version control, integrity checks, access restrictions to model registries, and input validation to detect adversarial attempts.
Security Policies Enforcement: We strictly enforce security policies across the organization, covering everything from acceptable use of systems to data handling protocols. These policies are regularly reviewed and updated to align with evolving industry standards, regulatory requirements, and emerging security risks
Data Handling: We have established rigorous data handling procedures to maintain the integrity and security of data. This includes encrypting data both in transit and at rest to protect it from unauthorized access during transmission and storage. For data at rest, we use AES-256 encryption, while data in transit is protected using TLS 1.2 or higher.
Data Loss Prevention (DLP): We have implemented measures to protect against unauthorized data exfiltration, including monitoring and controlling data movement within and outside the organization to prevent any potential leakage of sensitive information. DLP controls, monitors and blocks unauthorized transfers of training data, model weights, or AI system outputs.

User and Client Responsibilities

Every user is responsible for maintaining the confidentiality of their credentials. This means that users must ensure their login details are kept private and not shared with anyone. Users must also use Youverify’s services in a manner that is consistent with this policy, following all relevant guidelines and best practices. Additionally, users are expected to report any suspected security breaches or vulnerabilities they encounter to Youverify promptly to ensure quick resolution.

Clients are responsible for ensuring that they have a lawful basis for processing user data, in compliance with applicable data protection regulations. It is also their duty to provide clear and explicit instructions to Youverify regarding the processing of data. In the event of a security incident, clients must cooperate fully with Youverify, sharing relevant information and working together to manage the situation. Furthermore, clients must adhere to data retention policies and inform Youverify when data is no longer necessary, ensuring that proper data disposal or archiving procedures are followed.

Third Party Security

Youverify ensures that all third parties (e.g., data providers, subcontractors) who have access to our information assets adhere to this policy and maintain comparable security standards. This is achieved by conducting due diligence assessments of third-party security practices, including security requirements in contracts with third parties, regularly monitoring third-party compliance with security requirements, and implementing controls for onward transfer of data to third parties.

Where Youverify uses AI systems or components provided by third parties (e.g., large language models, computer vision libraries), we:

Conduct security and compliance assessments before integration.
Require contractual commitments to security standards, including incident reporting and data protection.
Monitor for vulnerabilities and security bulletins affecting third-party AI.
Maintain an inventory of all third-party AI components in use.

Incident Response

At Youverify, we have developed a comprehensive incident response plan to address any potential security breaches. This plan is designed to ensure a quick, efficient, and organized approach to mitigating security risks and minimizing their impact. The key components of the incident response plan include:

Data Breach Protocol: In the event of a security incident, including the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data, Youverify will immediately activate our data breach protocol. This involves initiating a detailed investigation to determine the scope, cause, and impact of the breach. We will assess the potential risks to the affected data and prioritize actions to contain the breach and prevent further damage
Reporting Security Vulnerabilities: If any user identifies a security vulnerability or bug in our services, they are required to report it to the Youverify Security Team immediately. The designated contact for reporting vulnerabilities is security@youverify.co. This ensures that we can address potential security weaknesses promptly and protect the integrity of our services.
Communication Protocols: We understand the importance of timely communication in the event of a security incident. Our communication protocols ensure that all affected parties, including users, clients, and regulators, are notified in a clear and efficient manner. In compliance with legal requirements, we will notify the relevant parties within the specified time frame (72 hours of becoming aware of the breach, where required). This communication will include detailed information about the nature of the breach, the steps being taken to resolve it, and any actions affected parties should take.
Containment, Eradication, and Recovery Procedures: To minimize the impact of a security incident, Youverify has established containment and eradication procedures. These procedures are designed to immediately contain the incident, prevent further harm, and eliminate any malicious or unauthorized activity. We then focus on recovery, restoring affected systems and services to their normal operational state. Our goal is to ensure minimal disruption to users and clients while securing sensitive data.

Compliance

To demonstrate our commitment to global data protection standards, Youverify complies with the following regulatory and certification frameworks:

ISO/IEC 27001:2013 certification – ensures we maintain a robust Information Security Management System (ISMS).
ISO/IEC 42001:2023 - AI Management System (in implementation).
Nigeria Data Protection Act (NDPA) 2023 – enforced by the Nigeria Data Protection Commission (NDPC).
Protection of Personal Information Act (POPIA) – South Africa.
UK Data Protection Act 2018 and UK GDPR – regulated by the Information Commissioner’s Office (ICO).
Kenya Data Protection Act, 2019 – enforced by the Office of the Data Protection Commissioner (ODPC), Kenya.
EU AI Act - where applicable to our AI systems.

Continuous Improvement

At Youverify, we view information security as a continuous, evolving process. Our Information Security Management System (ISMS) is reviewed annually to ensure effectiveness and alignment with industry standards, regulatory changes, and emerging threats.

We conduct biannual internal audits to assess compliance, identify vulnerabilities, and drive improvements. Independent external reviews further validate the robustness of our security controls.

Through ongoing risk monitoring, regular updates to mitigation strategies, and incorporating feedback from audits and incidents, we continuously strengthen our security posture to meet the highest standards of protection and accountability.

Contact Youverify

United States

privacy@youverify.co

315 Montgomery Street, Suite 900 San Francisco, CA 94104

South Africa

informationofficersa@youverify.co

Privacy Office Youverify Inc. 24 Cade Street South Crest Alberton Gauteng 1449

Nigeria

privacy@youverify.co

1st Floor, Sum House, 350 Borno Way, Yaba, Lagos.

Europe

privacy@youverify.co

Switzerland

privacy@youverify.co

Kenya

privacy@youverify.co

Delta Corner, Oracle Tower, 13th floor, Chiromo Road, Westlands, Nairobi, Kenya.