Security overview

Last updated 10 August 2026 · for supplier assessments and procurement

This sets out how footage sent to Veriframe is protected. It is written to answer the questions a police force, insurer or transport operator asks before sending evidential material to a supplier. Everything here is a description of what the service actually does, and what it does not.

In short

Who we are	Veriframe Ltd, registered in England and Wales no. 17390632. Registered with the ICO as a data controller, ZC219332.
Where data is held	The United Kingdom, on infrastructure we control, in data centres certified to ISO/IEC 27001. Footage is never copied anywhere else.
How long	Automatically deleted 24 hours after conversion, or about 15 minutes after you download it — whichever is sooner.
Who can reach a job	Only someone holding its link. We store the link as a one-way hash and cannot reproduce it.
Conversion isolation	Runs with no network access at all, no ability to write outside that one job, and capped memory and CPU.
Backups of footage	None, deliberately. A backup would outlive the deletion promise.
Use of your material	Converted on your instruction and nothing else. Never shared, never sold, never used to train anything.

Retention and deletion

Deletion is enforced by the software on a timer, not by anyone remembering to do it:

• The export you send is deleted as soon as conversion succeeds — we never hold the original and the result at the same time.
• Converted footage is deleted 24 hours after it is ready, whether or not it has been downloaded.
• Downloading brings deletion forward to about 15 minutes.
• A job that fails is kept for 2 hours, only so you can ask us to look at why — then deleted automatically. Ask us to look, and it is kept as a sample on the same terms as any other; do nothing and it goes. One abandoned part-way is deleted within 6 hours.
• You can delete a job yourself at any time from its page.

Every deletion is logged with its reason, the volume removed and a timestamp. We can evidence that footage was destroyed rather than simply assert it, and will provide that record on request.

Capacity is deliberately limited, and the service refuses new work when it approaches full. Storage that cannot grow is a retention policy that cannot quietly be outgrown.

Isolating the conversion

Converting a proprietary CCTV export means parsing undocumented binary from an untrusted source. That is treated as hostile:

• No network access. The conversion process cannot make outbound connections of any kind, so nothing in a malformed export can reach out.
• Confined filesystem. It runs with a read-only system and write access to that single job's directory — it cannot see another customer's job.
• Capped resources and a hard time limit, so one export cannot exhaust the machine or hang indefinitely.
• Unprivileged. It runs as a dedicated account with no login shell and no administrative rights.
• Uploads are checked by file signature, not filename, and archives are refused if they expand disproportionately.

Access control

Job links	256-bit random. Stored only as a SHA-256 hash, so a copy of our database yields no working link to anyone's footage.
Accounts	By invitation. Sign-in is a single-use link valid for 20 minutes — there are no passwords to steal, reuse or leak.
Separation	An organisation sees only its own jobs. Membership and status are re-checked on every request, so removing someone takes effect at once.
Job pages	Excluded from search engines and sent with no-store, so they are not cached or indexed.

Platform

• All traffic is encrypted in transit, and the service is served over HTTPS only.
• Administrative access is restricted to named individuals and uses cryptographic keys rather than passwords.
• Infrastructure is firewalled, with automated blocking of repeated failed access attempts.
• Security updates are applied automatically.
• Job links are redacted from access logs before they are written, so credentials never reach a log file.

Certified hosting

Veriframe runs in United Kingdom data centres certified to ISO/IEC 27001 for information security management, and to ISO/IEC 27017, 27018 and 27701 covering cloud security and the handling of personal data. The controls described on this page are ours, and sit on top of that certified environment.

We are glad to complete a supplier security questionnaire covering both.

Sub-processors

Who	Purpose	Location
OVH	Hosting and email	United Kingdom / EU
OpenStreetMap	Street-map tiles, fetched once during conversion and embedded in the player, for recordings containing GPS. A request covers the map area the recording moved through; no footage, filenames or account details are sent, and the finished player contacts nobody.	EU

No analytics, advertising or tracking services are used anywhere on this service.

Incidents

If a personal data breach affecting your material occurred, we would notify you without undue delay and within 72 hours of becoming aware, with what we know, what is affected and what we are doing. Our short retention window materially limits exposure: in most cases footage from more than a day ago no longer exists to be affected.

Deletion is final

Footage is not backed up, replicated or archived. That is a design decision rather than an omission: a backup would outlive the deletion schedule above and quietly defeat it. When we say a job has been deleted, there is no second copy anywhere.

It follows that Veriframe should never hold the only copy of anything. Download what you need and keep it in your own systems.

Contracts and questions

Veriframe Ltd is registered with the Information Commissioner's Office under registration number ZC219332.

Where we convert footage for you we act as your processor. Our data processing agreement is published in full and applies automatically — you do not have to ask for it, and we will sign a copy or complete yours if your process needs that. We are happy to complete your own security questionnaire, and to provide deletion records for any job.

enquiries@veriframe.co.uk · see also our privacy notice and terms.