Security, privacy and compliance
Verilak works entirely on your own workstation. Your documents do not go to the cloud and not to the supplier. Below you can read how Verilak is secured and how it fits the frameworks for Dutch government.
Offline and isolated
No cloud, no account
Verilak never connects to the supplier. No account and no licence server on the internet are needed.
One isolated process per file
Every file is processed in a separate process without network access and with a time limit. A malicious or broken file cannot affect the rest.
Sandbox at system level
Helper programs such as FFmpeg and Tesseract run in a Windows AppContainer, without network access and without access to your files. LibreOffice runs at a low integrity level.
Protected temporary files
Temporary files are stored encrypted, can only be read by the user and are overwritten before they are deleted.
How Verilak fits the frameworks for government
| Framework | How Verilak fits |
|---|---|
| GDPR (AVG) | Processing on your own workstation, no storage after processing, no content or metadata values in log files. DPIA documentation available for the data protection officer. |
| BIO | A mapping of the Baseline Information Security for Government (BIO) controls to the functions of Verilak, for the CISO. |
| Woo | Legal ground per redaction, Woo inventory list, consistent redaction within a case file and publication as PDF/A. |
| Archives Act | PDF/A for long term accessibility. An audit log with a hash chain that cannot be changed unnoticed. Originals are never overwritten. |
| Digital accessibility | Accessible PDF/UA as output. The app can be used with keyboard and screen reader (WCAG 2.1 AA, EN 301 549). |
| Algorithm register | A description per detector: rule based or trained model, known error margins and mandatory human review. |
| AI Act | Text detection works with fixed rules. Face detection only indicates where a face is; it identifies nobody. Minimal risk. |
| Cyber Resilience Act | A process for reporting vulnerabilities, an SBOM per release and pinned dependencies. |
| Open standards | PDF/A, PDF/UA, ODF and the Dutch API Design Rules, under the comply or explain policy. |
People decide
Detection of personal data only makes proposals. Publishing without review by a staff member is technically impossible. That keeps responsibility where it belongs, and you meet the requirement of human intervention.
Demonstrably clean
Every run produces evidence: a hash of the file before and after, a second check with another parser and an entry in the audit log. The audit log is a hash chain: if anyone changes something afterwards, the check shows it. You can export it as CSV or as PDF/A.
Found a vulnerability?
We follow the Coordinated Vulnerability Disclosure guideline of the Dutch NCSC. Report a vulnerability to info@verilak.nl. See also security.txt.
Documentation for your CISO and DPO
In the pilot you receive the BIO mapping, the DPIA documentation and the description for the algorithm register.