Privacy Policy

1. Introduction & Scope

Verity Software Solutions ("Verity", "we", "us", or "our") respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how Verity collects, uses, stores, protects, and discloses information when you use our software platform, website, applications, and related services (collectively, the "Services").

Shared Responsibility and Data Roles: Verity provides a configurable business software platform designed for organizations to manage operations through custom modules. In the context of applicable privacy laws, the customer (the organization subscribing to Verity) acts as the Data Controller, determining what data is collected and how it is used. Verity acts strictly as the Data Processor, processing information solely on behalf of the customer and in accordance with their configurations. Customers are responsible for ensuring they have the appropriate authority and consent to collect and process information entered into the platform.

By using Verity, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Account Information

When creating an account, Verity collects standard identity credentials:

• Email address
• Password credentials (managed securely through Amazon Cognito; passwords are not stored directly by Verity)

2.2 Information Stored by Customers (Customer Content)

Customers may enter diverse operational and personal information into Verity. This may include:

• Employee and contractor information (names, contact details)
• Operational records, certifications, and safety tickets
• Uploaded files, documents, and images
• Custom data fields created through Verity modules

2.3 Location Information and Geofencing

To facilitate operational requirements, field safety reporting, and site verification, Verity may collect location data from user devices.

• Data Types: Precise GPS coordinates, geofence crossing events (entry/exit timestamps for work zones), and location metadata attached to submitted business records.
• Device Permissions: Location data is collected only if explicitly authorized at the device operating system level. Users may revoke this at any time, though it may limit the functionality of organization-mandated modules.
• Offline Queuing: In remote environments without cellular service, timestamped location data is securely stored locally and synchronized with our cloud infrastructure once connectivity is restored.

2.4 Technical & Diagnostic Information

To ensure reliability and security, we collect limited system data, including:

• Authentication tokens and session data
• Application logs, error reports, and system performance metrics
• Device type and operating system versions

Verity does not use third-party advertising, analytics, or behavioral tracking services.

3. How We Use Information

Verity processes collected data strictly to execute operational workflows defined by the customer. We use this information to:

• Provide, operate, and maintain the Services
• Authenticate users and enforce organizational access controls
• Verify geographical compliance for site access and safety reporting
• Synchronize data efficiently between offline devices and the cloud
• Troubleshoot errors, monitor cloud infrastructure, and improve platform reliability

Verity does not sell personal information to third parties or data brokers.

4. Offline Functionality & Local Storage

Verity is engineered with an offline-first architecture designed for remote field operations.

• Browser-Level Storage: To allow uninterrupted workflows without internet connectivity, the application utilizes modern browser storage technologies (such as IndexedDB) to securely cache data locally on the user's device.
• Synchronization: When network connectivity drops, payloads are managed in a local offline queue. Upon connection restoration, data is securely synchronized to the cloud utilizing timestamp-based conflict resolution.
• Device Security: Because data may temporarily reside on mobile devices, users and their organizations are responsible for enforcing device-level security (e.g., screen locks, MDM profiles) to protect locally stored information.

5. Subprocessors & Third-Party Integrations

Verity leverages trusted, enterprise-grade service providers to host and operate the platform.

AWS Cloud Infrastructure

Verity operates on Amazon Web Services (AWS). Services utilized include Amazon S3 (object storage), DynamoDB, Cognito (authentication), Lambda, API Gateway, and CloudWatch. These services process information only to provide infrastructure capabilities.

Payment Processing

We utilize Stripe to process subscription and billing payments. Verity does not process or store complete credit card information on our servers.

Artificial Intelligence & Integrations

Certain optional integrations may utilize Microsoft, Google, or OpenAI services. Verity enforces strict data privacy boundaries: customer data is never used to train third-party artificial intelligence models, nor is it used for automated decision-making or AI profiling. Data is routed to these services only when explicitly required to execute a customer-enabled feature.

6. Security Measures & Data Isolation

Verity employs robust technical and organizational safeguards:

• Strict Multitenancy: Data isolation is a foundational architectural rule. Every database transaction strictly enforces organizational IDs to guarantee multitenancy security, ensuring one organization's data is cryptographically separated and inaccessible to others.
• Encryption: Data is encrypted at rest (using AWS managed keys) and in transit (via secure HTTPS/TLS communication).
• Access Controls: Role-based access controls (RBAC) restrict data access based on user permissions defined by the organization's administrator. Verity employees have restricted, heavily audited access limited to what is strictly necessary for critical system support.

While we employ enterprise-grade security, no internet-connected system is entirely infallible. Users must protect their account credentials and physical devices.

7. Data Retention & Deletion

Verity retains information only for as long as necessary to provide the Services and fulfill our contractual obligations.

• Customer data history and system backups are retained for approximately one year for disaster recovery, record-keeping, and accidental deletion restoration.
• Upon termination of a contract or a verified deletion request by the Data Controller, primary data is permanently destroyed. Deleted information may persist in encrypted, immutable backup archives until the standard retention cycle expires.

8. Your Privacy Rights

Depending on applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA), individuals have rights regarding their personal information.

Because Verity is a Data Processor, end-users (e.g., employees of our customers) seeking to exercise rights to Access, Correct, or Delete their data should direct their requests to their employer (the Data Controller). Verity will promptly assist our customers in fulfilling these legal requests.

9. Cookies and Local Technologies

Verity utilizes standard HTTP cookies and local storage (e.g., IndexedDB, LocalStorage) strictly for core functional purposes:

• Maintaining authenticated user sessions
• Executing offline data queuing and synchronization
• Securing the platform against unauthorized access

Verity does not deploy third-party tracking, advertising, or behavioral cookies.

10. Children's Privacy

Verity is a B2B platform designed exclusively for industrial and enterprise operations. The Services are not intended for, nor do we knowingly collect personal information from, children or minors.

11. Data Breach Notification

In the event of a security incident resulting in the unauthorized access or disclosure of personal information, Verity will promptly investigate the breach. We will notify the affected Data Controller (the customer organization) without undue delay, providing the necessary information and cooperation required for them to fulfill their notification obligations under PIPEDA, PIPA, or other applicable regional laws.

12. International Data Processing

Verity operates out of Alberta, Canada. However, to leverage world-class infrastructure, data is processed through our AWS cloud environment and third-party subprocessors. Consequently, data may be transferred to, stored, or processed in jurisdictions outside of Canada (such as the United States), where it may be subject to the laws of those jurisdictions.

13. Changes to This Privacy Policy

Verity may update this Privacy Policy periodically to reflect technological advancements, architectural changes, or legal requirements. Updated versions will be posted within the platform and will include a revised "Effective Date."

14. Contact Us

For privacy-related inquiries, compliance requests, or questions regarding this policy, please contact: