What this site collects, and what it does not.

Viimeksi päivitetty · 3. marraskuuta 2026

What this site does not do

This site uses no advertising cookies, no social media buttons and no third-party hosted fonts. Typefaces are served from this domain.

The VERA software sends no telemetry. This page covers the site, the account, the software's licence check, the connections the software makes when its VERA Internet connection is on (see the section on the VERA software) and the placement at VERA Forensics.

Audience measurement

On veraforensics.com (production), the site loads Microsoft Clarity (Microsoft Corporation, United States): heatmaps and session recordings. Advertising is off. The script is not loaded on gated access pages or on the staging site.

To object to this processing, write to alexandre@veraforensics.com.

Recordings can include mouse movement and on-screen text. Form fields are masked in Clarity. Do not type investigation data into this site.

News by email (newsletter)

There are two ways to receive it. Either you subscribe from the site: your email address is stored with the site language, the page you subscribed from, the date, and a one-way hash of your IP address used only to limit automated abuse. Subscription is confirmed by an email containing a link; without that click the address stays pending and is never used. Legal basis: your consent.

Or you have a VERA account in an organisation whose access is approved: you then receive the what's new summary of the software, unless you object. Legal basis: VERA Forensics' legitimate interest in keeping its users informed about the software they use. You are told when the account is opened and in every message.

In both cases: at most one message a week, an unsubscribe link in every message (one click, no sign-in) and a switch in your account. No tracking pixel, no click tracking. Messages are sent in the name of VERA Forensics from a dedicated subdomain.

When you unsubscribe, the address stays on our list, marked as unsubscribed, so that we do not write to you again. That is all we keep for this purpose, for as long as needed to respect your choice. While you are subscribed, the address is kept to send the messages.

Demonstration requests

The form collects your name, organisation, role, country, work email, what you are asking for (demonstration, evaluation, subscription or licence) and, if you choose, a message. These are used to review the request, reply to it and prepare the session. Sending the form opens an account for your address and sends a sign-in link, without giving any access to the software: access is granted only after the request is reviewed.

Legal basis: pre-contractual steps taken at your request. Retention: three years after the last exchange, then deleted.

Sales prospecting

VERA Forensics may write to you in a professional capacity about a demonstration, an evaluation, the software or a commercial collaboration, if your organisation carries out digital investigations or judicial work, or offers digital forensic software or services. Contact details come from public professional sources (organisation websites, directories, publications) or from a direct exchange (a trade event, a recommendation).

Data processed: name, organisation, role, professional e-mail and phone number, country, and the history of exchanges (messages sent and received, follow-up notes, reply or no reply).

Legal basis: legitimate interest of VERA Forensics in presenting its software to bodies that could use it or offer it (GDPR Article 6(1)(f)). Each message is limited to a professional purpose, and you can ask not to be contacted again at any time.

Objection: reply "stop" or write to alexandre@veraforensics.com. We stop writing straight away, the address is marked and is no longer used for prospecting.

Retention: five years after the last exchange. After that, the sheet and the messages are deleted.

Hosting: this follow-up is kept on Supabase servers (Frankfurt). Messages are sent from Zoho Mail (European Union).

Erasure: an erasure request is carried out within thirty days. The sheet is removed from follow-up and the messages exchanged are deleted. We keep only the date of the request and the address, so that we do not contact you again.

Access to restricted documents

Where a personal access link is issued to you, acceptance of the confidentiality wording is timestamped against your email address, and views of the document are logged. This records who received what and allows access to be revoked.

Legal basis: legitimate interest in protecting information held as a trade secret. Retention: three years.

VERA account

The account (access requests, downloads, licences, subscription, balance) is hosted by Supabase in Germany (Frankfurt). It stores professional identity, organisation, entitlements, consents, an audit log, the account balance and AI usage events. Assistant conversations at the placement at VERA Forensics are described in the next section. Legal basis: contract and legitimate interest in securing access. Retention: the life of the relationship, then three years.

Licence and download traceability

Each licence key is personal. It contains its holder's name and work e-mail address and a short identifier, which the software may show on screen and write into its exports. Each installer, map, translation pack and demonstration case download is recorded: account, date, version, a hash of the IP address and the text of the terms accepted.

Purpose: protect the software against unauthorised distribution, and be able to trace a copy, a screenshot or a key in circulation back to its holder. Legal basis: VERA Forensics' legitimate interest in protecting its trade secrets and copyright. Retention: the life of the licence, then five years.

Licence check and workstation activation

A licence key is activated for one workstation. When the workstation has a network, the VERA software sends VERA Forensics, at activation, at start-up and then about every six hours: the key's identifier, a fingerprint of the key, the workstation code (derived from the machine identifier, which it does not reveal), the software version and, as with any connection, the IP address, of which only a hash is kept to limit abuse. VERA Forensics answers whether the key is still valid on that workstation, and dates its answer. No case data is sent. Without a network, the software works as usual.

VERA Forensics keeps, for each key, the workstations activated, their activation date, the date and version of their last check, and the workstations freed. Purpose: enforce the licence (one key per workstation, withdrawal of a revoked key). Legal basis: performance of the licence contract and VERA Forensics' legitimate interest in protecting its software. Hosting: Supabase, Germany (Frankfurt). Retention: the life of the licence, then five years.

Payment (Stripe)

The yearly subscription of independent experts and account top-ups are paid through Stripe (Stripe Payments Europe, Ltd). VERA Forensics does not receive or store card numbers. Stripe processes payment data to perform the contract. Invoices, the payment method and cancellation are available in the billing portal opened from the account. VERA Forensics keeps the subscription state, its dates, and the time and text of the accepted order, to perform the contract and to be able to prove it; accounting records are kept ten years.

AI at VERA Forensics

By default, AI runs on the workstation or on the service server: that is offline, and nothing leaves. Only if you decide not to run the models yourself and select the placement at VERA Forensics does VERA send off the workstation the query text, the extracts needed for search or the Assistant, photos and a few frames taken from videos for search by meaning, and audio to transcribe when used. That processing happens only after a separate consent in the application. Case files stay on the workstation.

In that case only, this data is processed by inference processors, all based in the United States: DeepInfra (open models: text, text meaning, transcription), Google (photo and video meaning, and its models if you choose them), OpenAI and Anthropic (only if you choose one of their models). The examiner chooses the model in VERA's settings, where each model shows its maker. VERA Forensics uses no processor based outside the United States and the European Union.

Hosted translation, if you choose it: the text of the message to translate goes to DeepL, a European company, when DeepL covers the language, and to Anthropic otherwise. The examiner can choose the other engine. Text is sent message by message, at the examiner's request. DeepL keeps the text under the data processing agreement in force. Traces of these translations follow the setting for Assistant conversations described above.

Assistant conversations: VERA Forensics keeps the full content of the conversations held at this placement (questions, answers, the model's reasoning, tool calls and their results), which may contain case data, to diagnose and improve the service. Images, audio and video are never kept, only their hash. Hosting: Supabase, Germany (Frankfurt). Access: VERA Forensics only. Retention: as long as the account exists. An organisation can ask for this storage to stop and for its conversations to be erased at alexandre@veraforensics.com. Legal basis: contract and legitimate interest in diagnosing the service. The API also meters usage to charge the account.

The workstation and service-server placements send no AI request and no case data to VERA Forensics or to those processors.

Processors

Form and account data is processed by Supabase (European Union) and by an email provider (Resend), for account messages and for the news. The site itself is served from a server in the European Union (PulseHeberg, Toulon).

Microsoft Clarity processes browsing data, including outside the European Union. Stripe processes payments. Inference processors (DeepInfra, Google, OpenAI, Anthropic) and the translation processor DeepL receive data only if you choose the placement at VERA Forensics or hosted translation, and consent to it. No data is sold, exchanged or passed on for commercial purposes, to anyone, ever.

Your rights

You have rights of access, rectification, erasure, restriction and objection, and a right to portability. Write to alexandre@veraforensics.com: the request is handled within thirty days and there is no procedure to follow.

You may also lodge a complaint with the CNIL, the French supervisory authority.

The VERA software

This policy covers the website and the account. VERA runs on the customer's own infrastructure, with no telemetry. Case files stay on the workstation. Only the placement at VERA Forensics, if chosen and consented, sends data to inference processors and keeps Assistant conversations, as described above.

Apart from the licence check and the placement at VERA Forensics described above, the software connects to the following services only when its VERA Internet connection is on (Settings, General; off by default), with one exception: reading the public library catalogue, which happens even with the connection off. That setting has no effect on the licence check. One more exception: the error report you agree to send yourself (see below). Without a network, none of these connections happens.

Public library, served by VERA Forensics: when it is updated, at your request or when a case seal is processed, even with the connection off: the catalogue is only read. The request carries the workstation's IP address and the file requested. No case data is sent.

AI models, from Hugging Face (a third party): when a model is downloaded. The workstation sends the identifier of the model requested and its IP address. No case data is sent.

Map basemap, from OpenStreetMap (a third party): when the OpenStreetMap basemap is shown, by default when the connection is on; a setting limits the software to the local pack. The workstation sends the areas viewed and its IP address. No case data is sent.

Hosted translation, if you choose it: see "AI at VERA Forensics" above. The text of the message to translate goes to the provider chosen.

Error reports, to VERA Forensics: when the software shows an error, it sends the error, the latest lines of its log and what the licence says (holder, institution, e-mail address, key identifier, workstation code). Seal files and case contents are not sent, but a log line can name a file or a case; the Windows user folder, e-mail addresses and tokens are removed from the log before sending. With the Internet connection on, sending is automatic. With it off, the software offers to send and does so only after you press "Send logs", without turning the connection on. Logs are not kept on the server: the report is passed on by e-mail to VERA Forensics.

Notice: before the first call to OpenStreetMap, and before the first use of a hosted model, the software shows a notice. Until it is accepted, those calls do not happen: the local basemap replaces OpenStreetMap.

Maps, translation packs and installers are downloaded from the account, in the browser, and each download is logged. The software does not download these packs itself.