Trust center
For DPOs, compliance and procurement teams reviewing Vetro Attest before purchase.
Data Processing Agreement (GDPR Art. 28)Public signing key
In one paragraph
Free verification runs in memory and stores nothing. A purchased attestation stores the ledger you upload for 7 days, then deletes it automatically. We never need your model provider keys, prompts outside the ledger you choose to upload, or access to your systems. Everything we sign can be verified offline against our public key, without trusting us.
Subprocessors
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Server hosting | Uploaded ledgers (purchases only, 7 days), purchase records, lead emails | Germany (EU) |
| Stripe Payments Europe, Ltd. | Payment, invoices, subscription management | Billing name, email, payment method (we never see card numbers), ledger digest in payment metadata | Ireland (EU); transfers under Stripe's SCCs |
| Resend, Inc. | Transactional email (report delivery, and the guides you asked for) | Recipient email, report attachments | United States; transfers under SCCs / EU-US Data Privacy Framework |
We notify customers of a new subprocessor at least 14 days before it starts processing their data; see §7 of the DPA.
Where data lives and for how long
| What | Stored? | Retention |
|---|---|---|
| Ledger checked with free verification | No: processed in memory | None |
| Ledger uploaded for a paid attestation | Yes, on our EU server | Deleted automatically after 7 days; your emailed report and attestation stay yours |
| Ledger digest (SHA-256) | Yes, in the attestation and Stripe metadata | As long as the payment record (tax law) |
| Email left on a free tool | Yes | Until you unsubscribe or ask for deletion |
| Analytics | Aggregate counters only, no cookies, no trackers | — |
If your ledgers contain personal data (for example end-user prompts recorded by your agent), you are the controller and we act as your processor under the DPA. You can redact or hash fields before upload: the attestation covers the ledger exactly as uploaded.
How the signing works
- Tamper evidence: each ledger entry is hash-chained (SHA-256) and signed with your own ed25519 key; any edit, deletion or reordering breaks verification.
- Countersignature: Vetro Attest signs the ledger digest with its server ed25519 key. The public key is published at /api/pubkey; the private key never leaves the server and is stored with owner-only permissions.
- Independent verification: the open-source
vetro verifyCLI checks chain, signatures and our countersignature offline. You do not have to trust our server to trust the result. - What a signature does not mean: it attests integrity and that we saw that exact ledger at that time. It is not a certification by a notified body or legal advice (see Terms).
Security basics
- TLS on every endpoint; no plain-HTTP access to data.
- Subscription API keys are derived from the Stripe subscription and signed server-side; revoke by cancelling.
- No third-party scripts on any page, so no data leaves your browser except what you submit.
- Security reports and data-subject requests: attest@lumnika.com. We notify affected customers of a personal data breach without undue delay and within 48 hours of becoming aware of it.