Meeting and exceeding security requirements.

HIPAA

Verifyle is HIPAA compliant (U.S. Health Insurance Portability and Accountability Act), and will enter into a Business Associates (BA) agreement with our Covered Entity (CE) customers when appropriate. Our CE customers and their BA partners can use Verifyle to maintain a security level that is equivalent or greater than those required to protect electronic health records. Verifyle can be used in compliance with Title 42 CFR Part 2.

CCPA

Verifyle is compliant with the California Consumer Privacy Act (CCPA). We do not sell, rent or exchange our users’ personal information with any third party for any reason. We do use cookies to enhance the user-experience, preserve security and to record anonymous usage data. Our users can choose to delete all personal information contained within Verifyle by simply deleting their Verifyle account.

GDPR

Verifyle is compliant with the EU General Data Protection Regulation. We use proprietary technology to protect our users’ privacy and we will never rent or sell our users’ personal information to others. You can read more in our privacy policy.

UETA and ESIGN

The Uniform Electronic Transactions Act (UETA), and the United States Electronic Signatures in Global and National Commerce Act (ESIGN), have the following four primary requirements in order for an electronic signature to be considered valid:

Intent to sign – Electronic signatures are only considered valid if all signing parties intended to sign.

Consent to do business electronically – All parties to the transaction must give their consent to do business electronically (it is the responsibility of the user to acquire consent from all signing parties).

Association of signature with the record – The system used to capture the transaction must keep an associated record that reflects the process used to create the signature, or generate either a textual or graphic statement, which is added to the signed record, that proves that it was executed with an electronic signature.

Record retention – U.S. laws on electronic signatures and electronic transactions require that electronic signature records be capable of retention and reproduction by all parties.

Verifyle’s electronic signature solution can be used in compliance with these requirements.

Electronic Signing for Forms 8878 and 8879

Verifyle can be used in compliance with IRS guidance for electronic signing for Forms 8878 and 8879.

Taxpayers have the option of using electronic signatures for Forms 8878 and 8879 if the software provides the electronic signature capability. If taxpayers use an electronic signature, the software and the Electronic Return Originator (ERO) must meet certain requirements for verifying the taxpayer’s identity.

Verifyle signature requests can be used to automatically record all of the data required for an electronic signature to be considered valid by the IRS.
Learn more

IRS Publication 1345 E-File Standards

Verifyle complies with the following IRS security, privacy and business standards:

1. Extended Validation SSL Certificate
2. External Vulnerability Scan
3. Information Privacy and Safeguard Policies
4. Protection Against Bulk Filing
5. Public Domain Name Registration
6. Reporting of Security Incidents

Note: While Verifyle does deploy technology to prevent malicious bot activity, Verifyle cannot currently be used to submit tax returns to the IRS. Verifyle is therefore not considered an Electronic Return Originator (ERO), and is not required to deploy protection against bulk filing. If you are using Verifyle as an ERO to complete a remote transaction, you should be sure to satisfy any requirements regarding collecting and verifying personal information including social security number, address, and date of birth as part of this transaction. This information may be collected within a Verifyle thread, where it can be securely stored and shared with other authorized Verifyle users. Please refer to IRS publication 1345 for details.

PCI

Verifyle meets all requirements of the Payment Card Industry (PCI) Data Security Standard for a level four merchant. We do not store our users’ payment card data on our servers at any time.

CSA

In 2011, the Cloud Security Alliance (CSA) launched STAR, an initiative to encourage transparency of security practices within cloud providers. The CSA Security, Trust & Assurance Registry (STAR) is a free, publicly accessible registry that documents the security controls provided by various cloud computing offerings, thereby helping users assess the security of cloud providers they currently use or are considering contracting with. Our data centers are a CSA STAR registrant and has completed the Cloud Security Alliance (CSA) Consensus Assessments Initiative Questionnaire (CAIQ).

FERPA

The Family Educational Rights and Privacy Act (FERPA) is a Federal law that protects the privacy of student education records and applies to all schools that receive funding from any applicable program of the U.S. Department of Education. Verifyle gives our Covered Entity (CE) customers and their Business Associates (BA) subject to FERPA requirements a secure environment for storing and sharing protected education information.

FINRA/SEC

Information in Verifyle is stored and shared using our patented encryption technology, Cellucrypt. Our system can be used as a means for securely storing and sharing information in order to help our Financial Industry Regulatory Authority (FINRA) member customers to establish and maintain compliance. Verifyle protects the security and confidentiality of its users, guards against anticipated threats or hazards, and protects against unauthorized access to customer information.

NIST

In June 2015 The National Institute of Standards and Technology (NIST) released guidelines 800-171, "Final Guidelines for Protecting Sensitive Government Information Held by Contractors.” This guidance is applicable to the protection of Controlled Unclassified Information (CUI) on nonfederal systems.

Our data centers are compliant with these guidelines. NIST 800-171 outlines a subset of the NIST 800-53 requirements, a guideline under which our data centers have already been audited under the FedRAMP program. The FedRAMP Moderate security control baseline is more rigorous than the recommended requirements established in Chapter 3 of 800-171, and includes a significant number of security controls above and beyond those required of FISMA Moderate systems that protect CUI data.

Sarbanes-Oxley

If a customer processes financial information in the cloud using Verifyle, the customer’s auditors may determine that some Verifyle systems (e.g. our data centers and related services) come into scope for Sarbanes-Oxley (SOX) requirements. The customer’s auditors must make their own determination regarding SOX applicability. Because customers manage most of the logical access controls, the customer is best positioned to determine if its activities meet relevant standards.

PIPEDA

Verifyle can be used in compliance with Part 1 (Protection of Personal Information in the Private Sector) and Part 2 (Electronic Documents) of the Personal Information Protection and Electronic Documents Act (PIPEDA). We use proprietary encryption technology to protect our users’ privacy, and we will never rent or sell our users’ personal information to others. Our users can request access to any personal information held by Verifyle at any time and can challenge its accuracy. You can read more in our privacy policy.