Last updated: March 25, 2026
BLIND Processing: Vertifile never reads, accesses, or stores the content of your documents. We only process cryptographic hashes (fingerprints) of your files. Your document content never leaves your device.
Vertifile ("we," "our," or "us") operates the vertifile.com website and document verification service. This Privacy Policy explains how we collect, use, and protect information when you use our services.
We are committed to protecting your privacy. Our core architecture is built on the principle of BLIND processing, meaning we are technically unable to read or access the content of documents you protect with Vertifile.
When you protect a document, our system computes a SHA-256 cryptographic hash of your file. This hash is a one-way mathematical fingerprint that cannot be reversed to reconstruct your document. We store this hash for verification purposes.
If you create an API account, we collect:
We automatically collect standard technical information:
We do not collect, read, store, transmit, or access the content of your documents at any point. Our BLIND processing architecture means that document content is hashed entirely on the client side. Only the resulting cryptographic fingerprint is sent to our servers. It is mathematically impossible to reconstruct document content from a hash.
We also do not collect:
We use the information we collect for the following purposes:
Your data is processed and stored on cloud infrastructure located in the United States and Europe. Cryptographic hashes of your documents may be anchored on the Polygon blockchain, a public, decentralized network. No document content is ever transmitted to or stored on any server or blockchain.
We process personal data under the following legal bases as defined in GDPR Article 6:
When a document is protected, its SHA-256 hash and HMAC signature are registered on the Polygon blockchain. These records are:
Blockchain records contain only cryptographic hashes, timestamps, and transaction metadata. No personal information or document content is stored on the blockchain.
We use minimal cookies for essential functionality:
We may use privacy-respecting analytics to understand how our service is used. We do not use third-party advertising trackers or sell data to advertisers. No tracking cookies or marketing cookies are used.
We retain data according to the following schedule:
We do not sell your data. We may share limited information with:
Vertifile uses the following sub-processors:
We will notify Enterprise customers 30 days before adding new sub-processors.
We implement industry-standard security measures including:
If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):
To exercise any of these rights, contact us at privacy@vertifile.com.
Vertifile acts as a Data Processor when processing documents on behalf of organizations using our API. For individual users, Vertifile acts as the Data Controller. Organizations using our Enterprise plan can request a Data Processing Agreement (DPA).
Document hashes anchored on the Polygon blockchain are cryptographic fingerprints that cannot be reversed to reconstruct document content. While blockchain records are immutable, the hash alone does not constitute personal data as it cannot be linked to an individual without additional information held separately by Vertifile. Upon account deletion, all linking information is permanently removed, rendering blockchain hashes anonymous.
When your data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place. International transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable. We evaluate the data protection laws of recipient countries and implement supplementary measures when necessary to ensure your data remains protected.
In the event of a data breach affecting personal data, we will notify affected users and relevant supervisory authorities within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Notifications will include the nature of the breach, the likely consequences, and the measures taken to address and mitigate the breach.
For privacy-related questions, concerns, or to exercise your data protection rights, please contact our dedicated privacy team at privacy@vertifile.com. We will respond to all privacy inquiries within 30 days.
Vertifile does not use automated decision-making or profiling that produces legal effects on users. Document verification is based solely on cryptographic hash comparison, not on document content analysis.
Vertifile does not knowingly collect personal information from children under the age of 16. If we learn that we have collected personal data from a child under 16, we will delete that information promptly. If you believe a child has provided us with personal data, please contact privacy@vertifile.com.
Our service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage users to review the privacy policies of any third-party service they interact with.
We may update this Privacy Policy periodically. Material changes will be communicated via email to registered users at least 30 days before taking effect. Continued use of the service after changes take effect constitutes acceptance. Previous versions of this policy are available upon request.
If you have questions about this Privacy Policy or our data practices, contact us at:
Vertifile
Rishon LeZion, Israel
Email: info@vertifile.com
Website: vertifile.com