Responsible use
Who I sell to is a decision, and I make it myself.
Software sold to police services deserves a page that says what the limits are. This one is written in the first person because there is nobody else here to hide behind, and because a policy nobody has personally committed to is not a policy.
Why this page exists
The industry earned the question.
Digital forensics has a reputation problem, and it earned it. Products sold as investigative tools have been found on the phones of journalists, lawyers and opposition politicians, and the companies involved usually discovered a policy after the story broke rather than before.
I am not going to pretend that VERA is exempt from that history because it is small or European. Anyone evaluating this software should be able to read what I will and will not do, decide whether it is credible, and hold me to it. That is the whole purpose of this page.
The distinction that matters
This is forensic software, not surveillance software.
VERA reads an extraction that already exists, taken from a device that is already in an investigator's possession, seized under a legal authority that was granted before the software was ever opened. It does not extract a device, it does not bypass a lock or device encryption, and it has no acquisition capability of any kind.
It cannot intercept a communication. It cannot reach a device over a network. It cannot be pointed at a person. Every one of those is a hard property of what the software is rather than a setting somebody could change, and it puts VERA in a materially different category from the products that generated the headlines.
That distinction limits the ways this software can be misused. It does not eliminate them, because a lawful seizure can itself be an instrument of repression, and a tool that makes analysis faster makes bad analysis faster too. The distinction is a reason to be careful about who buys it, rather than a reason to stop worrying.
Making evidence review faster is not neutral. It is useful to a service doing its job properly, and it is useful to a service doing something else.
The line
What I will and will not sell into.
The first list is the legal floor and it is not a commitment, because it is simply the law. The second list is where the actual decision lives.
Sold to
- Public authorities carrying out criminal investigations under judicial or equivalent independent oversight.
- National and regional forensic laboratories serving those authorities.
- Public prosecution services and courts, where they run their own examination capability.
- Academic and training institutions teaching digital forensics, on synthetic data.
Not sold to
- Any jurisdiction or entity under European Union or French restrictive measures.
- Private intelligence firms, corporate investigation companies and commercial data brokers.
- Units whose remit is the surveillance of journalists, lawyers, human rights defenders or political opposition.
- Any buyer who will not tell me what the software is for, or who wants it without a demonstration and without questions.
How the decision is made
There is no channel, so there is no gap in it.
Here is the concrete fact that makes the rest of this page checkable. VERA has no resellers, no distributors and no channel partners. There is no integrator who can put it in a bundle and no regional agent selling on my behalf. Every deployment that exists came from a conversation I had personally, and there is no route by which this software reaches a buyer I have not agreed to.
That is not a moral achievement, it is a consequence of being one person. But it is a real structural property, and it is worth more than a policy document, because the usual failure in this industry is not a written policy that says the wrong thing. It is a written policy that a distribution network quietly routes around.
I also expect to refuse sales that are perfectly legal. A licence being lawful to grant is the beginning of the assessment rather than the end of it, and if the only argument for a sale is that nothing prohibits it, that is not an argument I intend to accept.
Where I am fallible
What I cannot see, and will not claim to.
VERA has no telemetry. It makes no outbound connection, reports nothing, and I have no access to any deployment. That is the correct design for a customer whose evidence must never leave their building, and I would not change it.
It also means I cannot watch what a customer does. Once the software is installed inside a closed network, I have no technical means of knowing which cases it is used on, and no way to switch it off remotely. Any vendor in this position who tells you they can guarantee downstream use is either running telemetry they have not mentioned or is overstating what they control.
So my honest position is this. I control who I sell to, and I control it completely because there is no channel. I do not control what happens afterwards, and I am not going to describe a contract clause as though it were a technical control. What I can do is refuse the next sale, and say publicly why.
The other half of responsibility
Inside the case file, the same principle applies.
Responsible use is not only about who holds the licence. It is also about what the software encourages an examiner to do once they have it, and this is where most of the day-to-day risk actually sits.
VERA is built so that no output can enter a report without a human having checked the source. Every statement the assistant makes carries the exact file, table and row behind it, and verification is one click. Generated coverage is never applied to a case until an examiner has reviewed a preview over the real data and accepted it. Recovered records are marked as recovered so that a carved row is never mistaken for a live one.
Those are design decisions taken because a tool that makes it easy to skip verification will eventually be used that way, however carefully the manual is written.
If something is wrong
Tell me, and tell me publicly if you prefer.
If you believe VERA is being used in a way this page rules out, write to me at alexandre@veraforensics.com. I will answer, and if the concern is well founded I will say so here rather than only to you.
If you think a commitment on this page is too weak, or too vague to be worth anything, that is also worth writing to me about. This page is meant to be held against me. It is not much use if it cannot be.
Alexandre Ansart
Ossire · alexandre@veraforensics.com
Ask the difficult questions in the demonstration.
The session is thirty minutes and there is no script. If the questions you want answered are the ones on this page rather than the ones about features, that is a better use of the time.
Every request is reviewed before access is granted.