Who we are
LA Jobe & Company, Inc., doing business as Audit Consulting Services or ACS Group, provides VerifiAI. Write to 2100 Valley View Ln, Suite 303, Dallas, TX 75234, or email soc1@audit-consulting.com with the subject Privacy request.
This notice describes the workspace and customer program. It does not record acceptance for an existing user or start new retention clocks for old cases. Customer agreements and applicable law determine the respective roles of the organization and service provider.
Information and purposes
We process account and organization details, login and security records, uploaded reports, extracted text, review inputs, draft memos, reviewer decisions, source links and case audit records. Information comes from users, their organizations and operation of the service. The purchase program also keeps transaction references, payment status and Terms-acceptance records.
We use information to provide the review workspace, authorize access, process reports, preserve evidence and decisions, provide support and secure the service. We use account email addresses for verification, invitations, recovery and service messages. Optional marketing is separate from service acceptance.
Use of submitted reports is limited to providing, securing and supporting the customer's service. We do not sell customer report content, use it for advertising or use it to train our own models. Optional provider training or data sharing is not part of the service permission; any additional use requires a separate explicit agreement and appropriate controls.
Service providers and AI processing
Service functions use Vercel for hosting and private file storage, PostgreSQL hosted by Neon for records, a Docling PDF parsing service hosted by Railway, OpenAI for AI analysis, and Microsoft 365 for account email. Stripe collects payment details through hosted checkout when a customer makes a purchase. Providers process information for their service functions under their applicable terms and controls; a U.S. customer restriction is not a promise of U.S.-only processing.
AI analysis sends report-derived text and review context to OpenAI. Our analysis calls request that responses not be stored as application state. The production project uses Standard Retention with Global processing; optional provider data sharing is disabled. This is not Zero Data Retention. OpenAI may retain abuse-monitoring records, including submitted content, for up to 30 days under its standard controls, with longer retention where required by law or reasonably necessary to protect services or others from harm. Any enabled public auditor lookup uses the auditor name to obtain public information.
The parser removes its temporary PDF in normal completion and cleanup paths; this is not a guarantee that crash copies, logs or backups vanish immediately. Account emails contain account links and sent messages are retained under mailbox settings. Stripe handles full payment-card details; VerifiAI's records use transaction references and status rather than full card numbers or security codes.
Access and cookies
Organization administrators control membership and report permissions. The application uses sign-in, authenticator verification and server-side organization/case checks. Authorized operators and service providers may access information as needed for defined support, administration and security responsibilities. No system can promise absolute security.
Session and security cookies support sign-in and account protection. Agreement to service terms does not create consent for unrelated marketing or analytics. Provider platform cookies may also apply; this notice does not claim that every provider uses only necessary cookies.
Browser local and session storage support workspace preferences, resuming requested report processing and preventing duplicate processing requests. Processing markers contain identifiers and status information; older non-case review workflows can also keep review decisions and notes locally. Some items remain until the application or your browser clears them. Clearing site data may reset preferences or interrupted-work tracking; it does not delete server-side case records.
Current retention and requests
The current workspace retains original reports and case evidence so authorized reviewers can return to them. Archiving changes status; it does not delete the case. Current cases have not been assigned the new program's automatic expiry dates. Contact us to arrange organization-authorized export, closure or deletion, including review of any hold or shared evidence.
We verify identity and authority before handling access, correction or deletion requests. A member cannot authorize deletion of another organization's data. Case deletion is different from account closure or deletion of every provider copy. We identify transaction, security, legal and backup exceptions and explain them in responding to your request.
We aim to acknowledge requests within two business days and respond within 30 calendar days after identity and authority are verified, subject to any shorter applicable legal deadline. If an extension is permitted and needed, we will explain why and give an expected completion date. These targets do not narrow rights available under applicable law.
Retention schedule for the customer program
The following schedule is adopted for new program accounts and reports after launch and the applicable acceptance. It is not a statement that all deletion controls are already operating. Existing cases are preserved and do not expire retroactively.
Paid-credit report content: 24 months from successful processing. Free-report content: 90 days from successful processing. At least 30 days notice precedes scheduled expiry. Authorized users may export generated output and retrieve original PDFs for both free and paid-credit reports without a separate charge. Content expiry does not reset consumed credits or expire unused upload credits.
Unpaid reports that never successfully process: send notice after 30 days without activity, then allow 30 more days before scheduled removal. Unresolved jobs, payment/refund investigations and documented holds pause cleanup. Temporary uploads never attached to a case may be removed after 24 hours once confirmed unused.
Ordinary organization closure: a 30-day export period for an authorized administrator, unless earlier deletion is requested or legal/security restrictions prevent continued access. Eligible content is then targeted for active-system deletion within 30 days after scheduled expiry, the export period ends or a verified immediate-deletion request. Shared evidence needed by a retained report and documented holds are handled separately.
Restricted rolling backups: target expiry within 35 further days after active deletion. Routine operational/security logs: target 90 days from creation. Minimized financial records: seven years after the transaction. Terms-acceptance records, including beta-only acceptances: seven years after acceptance. These recordkeeping periods are business choices, not a statement that every record is legally required for seven years. Full SOC 1 reports are not included in the seven-year financial-record rule.
The 35-day backup and 90-day routine-log targets remain our operating commitments. Owner-controlled backup copies require a recorded creation date, finite expiry, restricted access and deletion reconciliation before restored data return to service. Holds require a reason and review date; a missed deadline requires investigation rather than an automatic extension. These controls do not prove physical erasure from every provider. Specific provider limitations appear below. Separate authentication, billing and case-audit records must be assessed rather than assumed erased by deleting a case. Verification of the controls and disclosed exceptions remains a prerequisite to opening the new program; publication alone does not establish completion.
Provider retention details
Vercel hosting and Railway parser log-viewing windows are not guarantees that every underlying provider copy has been physically erased. Vercel build and deployment records can remain with retained deployments. We keep report content and secrets out of application and build logs; operational records that need longer retention require a documented purpose and review. Neon point-in-time history is separate from our controlled backup copies. Provider-managed infrastructure recovery copies are governed by the provider’s applicable retention and legal controls, not by an application delete button.
Microsoft 365 retains account and support messages, including sent messages and deleted items, according to mailbox, Recoverable Items and applicable hold rules. Our support mailbox has no configured litigation hold or archive, but other retention and hold settings still require verification. We do not promise that deleting an application account immediately erases all email copies. Avoid emailing full reports or unnecessary sensitive information; use the controlled case workspace.
Stripe retains payment information under its applicable financial, fraud-prevention and legal obligations. These provider records are separate from our minimized seven-year transaction and acceptance records. They do not justify retaining full SOC 1 reports as financial records.
These limitations do not permit advertising, optional model training or unrelated use of customer content, shorten purchased storage rights, or apply new expiry dates to existing cases. For a deletion request, we identify known residual copies, applicable holds and expected next steps instead of claiming complete erasure while a known exception remains. Contact soc1@audit-consulting.com for the current status of a specific request.
Policy updates
We plan at least 30 days' notice before material changes, except changes needed sooner for legal or security reasons, which we will explain promptly. We will seek fresh acceptance where required and preserve existing purchased rights. We will not treat acknowledgment of this notice as blanket permission for unrelated uses or retroactively broaden customer-content use without appropriate consent.
These program terms describe beta access and report purchases offered through the application’s enabled workflows. Their publication is not consent to process a payment or to delete existing cases. Questions about these policies may be sent to soc1@audit-consulting.com.