Built for compliance-grade data -encrypted, isolated, US-only.

Database & storage

Supabase (PostgreSQL + Storage) with Row-Level Security enforcing strict tenant isolation at the database engine layer - even a compromised application layer cannot read another firm's records.

Hosting

Vercel edge + serverless runtime, TLS 1.3 for all traffic, encrypted deployment artifacts. The application is operated as a US-only service; data never leaves US regions.

Encryption

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Uploaded closing packages live in private, non-public buckets with signed-URL access only.

Data lifecycle

Raw uploaded closing packages are automatically removed from storage 90 days after a filing is completed; structured filing data and BSA XML remain available to your firm subject to your account and the 5-year BSA recordkeeping window.

Tenant isolation

Every filing, document, extraction snapshot, and entity-index record is tagged with a tenant ID and protected by RLS policies. Cross-tenant queries return zero rows by design.

Server-side only

The browser never calls model providers directly. All prompts and responses flow through VeroFin's backend where they are authenticated, logged, and scoped to a single tenant.

Zero Data Retention

We use OpenRouter and upstream LLM providers solely to perform extraction and validation for a given filing, via a dedicated key configured with Zero Data Retention (ZDR) and no-training settings. Prompts and outputs are not stored or used to train models.

Minimum necessary data

The AI sees only the documents needed to extract the 111 FinCEN fields for the filing in front of you. It has no cross-tenant access to your database and does not see billing or authentication data.

No auto-filing

VeroFin never submits reports to FinCEN. AI outputs are drafts; every filing is reviewed and submitted through the BSA E-Filing portal by your team.

Drafts, not decisions

A dual AI review (extraction pass + independent cross-validation pass) prepares the BSA XML, but the output is explicitly presented as a draft. You decide what to file and when.

Attorney review workflow

The platform is built around review and approval by licensed professionals. All legal determinations remain with your firm, not with the software.

Field-level context

Each extracted field includes a confidence score, the source document, the source page, and a verbatim source-text snippet - so your team can verify the AI's work in seconds, not minutes.

Immutable audit log

Every extraction, validation, edit, approval, retry, and filing event is recorded in an append-only audit log with full CSV export - an examiner-ready record of how each report was prepared.

Persistent entity index

Beneficial owners, LLCs, and trusts are deduplicated across your filings and linked to the closings they appear on. Repeat-party patterns surface in your tenant before they surface to a regulator.