Verbalu security pack
A concise description of the safeguards of the Verbalu service for the customer and its security team: where the data is, how it is encrypted, how sign-in, backups and updates work, who our subcontractors are and where to report an incident.
Information document, version 1.0, as at 12 November 2026. It describes the actual state of affairs, including where we do not have something today. Commitments towards the customer arise from the main agreement, the data processing agreement (DPA) and the security annex.
1. Provider and scope
The Verbalu service is operated by Octigo sp. z o.o., ul. Redycka 38/1, 51-169 Wrocław, Poland (KRS 0000360836, NIP 8951978011). Verbalu is a SaaS application for trainers, lecturers and training departments: it runs in the browser and as a mobile app for Android and iOS. This document covers the application, its server functions and the customer data stored in the service.
2. Hosting and data location
Verbalu runs entirely on Google Cloud and Firebase infrastructure; we do not maintain our own servers. The database (Cloud Firestore) runs in the eur3 multi-region in the European Union. Files are stored in Google Cloud Storage in the EU multi-region. Server functions and the real-time database run in the europe-west1 region in Belgium. Database backups are kept in eur3. We do not currently offer a choice of region. Data may leave the European Economic Area in two situations: when a user runs an artificial intelligence feature and the model provider processes the request outside the EEA, and during technical support provided by provider staff from outside the EEA. The basis in those cases is the EU-U.S. Data Privacy Framework or the standard contractual clauses approved by the European Commission.
3. Encryption
All communication between the browser or the mobile app and the service is encrypted (HTTPS, TLS protocol). Data in the database, files and backups is encrypted at rest using the default Google Cloud mechanism; the keys are managed by Google and we do not currently offer encryption with a customer-managed key. We neither store nor see user passwords: they are handled by Firebase Authentication. The organiser can additionally encrypt selected attendance list fields with their own password, which we do not store and cannot recover. We do not collect or store payment card data: payments are handled by Stripe.
4. Sign-in and multi-factor authentication (MFA)
A user signs in with a password, a Google account, an Apple account or a one-time code sent by email. Verbalu does not currently have its own second sign-in factor and cannot enforce MFA at organisation level. When signing in with a Google account, the safeguards of that account apply, including two-step verification if the customer enforces it in its domain. Sign-in with a password and with an email code is single-factor. Recommendation until our own MFA is implemented: require the trainers and administrators of the customer to sign in with a corporate Google account with two-step verification enabled. An organisation can verify its domain, and people with a corporate account then join without invitations. Session participants join with a code, a link or a QR code, without creating an account.
5. Access control and audit log
Permissions are checked by database rules on the server side, not only by the application screens; the same rules separate the data of different organisations. On the Octigo side, access to customer data is limited to persons who need it to maintain the service or handle a request, and who are bound by a duty of confidentiality. The application has an organisation audit log: member sign-ins, including failed ones, password changes, invitations, the addition and removal of members, changes to permissions and organisation settings, data exports and actions of Verbalu administrators concerning the organisation. Entries are written exclusively by server functions, each has a SHA-256 checksum, days are sealed and chained together, and the log is retained for 13 months. The organisation owner reviews it in the application.
6. Backups and recovery
A database backup is created automatically once a week, on Sunday. We retain each one for 60 days in the eur3 multi-region; backups are encrypted using the cloud provider mechanism and do not leave the European Union. We do not make daily or hourly backups, and point-in-time recovery is disabled, so in the worst case a restore rolls the state of the database back by a maximum of seven days. We do not currently declare a contractual recovery time and we have not yet carried out a documented full restore test. The customer can download its own export at any time: the organisation owner downloads the whole account as a single ZIP file and may treat it as an independent copy.
7. Updates and vulnerability management
The server layer is fully managed by Google Cloud, so updates to the operating system and the runtime environment are the responsibility of the cloud provider. We update application dependencies manually during development work, using the package manager warnings about known vulnerabilities; we do not currently have an automatic scanner that would block a deployment. We deploy new versions without interrupting the service, and the browser fetches the current version of the application by itself. We update the mobile app through Google Play and the App Store. In November 2026 we carried out an internal security review of the entire code; we deployed fixes for the findings of critical and high severity on 6 November 2026. We have not commissioned an external penetration test so far; we are ready to undergo a test commissioned by the customer in an agreed time window.
8. Availability and monitoring
The availability of Verbalu is checked from the outside by the independent UptimeRobot service. The current status and history are shown on the public status page: https://stats.uptimerobot.com/67oKoekA03. It runs outside our infrastructure, so it will open even when Verbalu is not responding. We do not currently offer a contractual availability guarantee (SLA).
9. Subcontractors
The table at the end of the document lists the entities that process data in connection with the service. We notify a customer with whom we have a data processing agreement of our intention to add or replace a sub-processor by email, at least 30 days in advance. Text in the AI features is generated by one provider selected for the whole service (Google Gemini, OpenAI or Anthropic); content reaches the model only when someone uses an AI feature. We do not train models on customer content. Outside the list are connectors that the user enables on their own (Notion, Nuclino, choosing a file from Google Drive): data then flows from the account of the user in those services to Verbalu.
10. Contact for incidents
Report an incident, a suspected incident or a security vulnerability to hello@verbalu.com, preferably with the subject "Security incident". The same address handles personal data matters; we have not appointed a data protection officer. We acknowledge receipt of a report no later than the next working day. We notify the customer of a breach concerning its data without undue delay, no later than within 24 hours of establishing it. The full course of action is described in the "Security incident response procedure".
11. What we do not have today
An ISO 27001 certificate, a SOC 2 report or an external penetration test (the Google Cloud infrastructure on which we run has its own certificates and reports). Our own MFA or the ability to enforce it in an organisation. SSO sign-in via SAML. Backups more often than once a week or a choice of data region. A contractual availability guarantee (SLA). Automatic vulnerability scanning in the deployment process.
| Subcontractor | Location | Scope |
|---|---|---|
| Google Ireland Limited and Google LLC (Firebase, Google Cloud) | EU: eur3, EU, europe-west1 | Core infrastructure: sign-in, database, files, server functions, hosting, push notifications, backups. |
| Google Ireland Limited (Google Workspace) | According to the Google terms | Email sent from the service: invitations, notifications, messages to participants, support correspondence. |
| Google (Gemini API) | Possibly outside the EEA | AI features: text generation (when it is the selected provider), images, AI search, transcription of recordings. Only at the request of the user. |
| OpenAI Ireland Limited | Possibly outside the EEA | AI features: text generation and transcription of recordings, when it is the selected provider. Only at the request of the user. |
| Anthropic PBC | USA | AI features: text generation, when it is the selected provider. Only at the request of the user. |
| Stripe Payments Europe | EU and USA | Payments and invoices in paid plans. Card data does not pass through our code. |
| Hotjar, Google Analytics, Google Ads | EU and USA | Analytics and advertising measurement. We store cookies only after consent is given in the cookie banner. |
| UptimeRobot | Not applicable | External measurement of site availability. It does not receive customer data. |