Frequently asked questions

Verazo's production infrastructure runs entirely on Hetzner, inside the EU. No AWS infrastructure and no Canadian infrastructure runs anywhere in Verazo's production environment.

You can cancel your subscription at any time from your billing settings. Cancellation takes effect at the end of your current billing period, unless the law requires an earlier date.

A general self-serve export of your organization's own data does not exist yet. Contact Verazo before your access ends if you need a copy of your records.

Four steps: create an account, connect an integration, add a control check, and read the result. Most accounts finish all four in under 15 minutes, with no credit card and no sales call.

Six today: ISO 27001, SOC 2, GDPR, DORA, NIS2, and the EU AI Act, 220 controls in total. Each control is labeled deterministic, agentic-assisted, or human-judgment, depending on whether a real check exists for it yet.

No paid plan exists yet. Creating an account, connecting an integration, and running a control check are free today, and nothing described on the product page is billed.

No. Verazo is evidence-and-readiness tooling, not a certification body. ISO 27001 certification and a SOC 2 report both come from a licensed external auditor examining an organization's own evidence, never from Verazo itself.

A screenshot proving an accessibility violation existed is kept for 10 years from the day it is captured, even after the violation is fixed. A single published retention period covering every other record type does not exist yet.

Email the contact address published in Verazo's security.txt file. Verazo does not yet run a formal bug-bounty or responsible-disclosure program, but a real person reads every report sent to that address.