Trust Center

Customer data lives in a SQLite database on the user's own device. Vrge does not host customer business data on its own servers.

Read-only access to every connected source. Where a provider offers a read-only OAuth scope, Gmail, Calendar, Drive — Vrge requests only that. Where none exists (Stripe Connect, QuickBooks Online) Vrge requests the narrowest scope available and enforces read-only in the client, which issues GET requests against an allow-list and never writes. Vrge cannot send email, modify calendars, or alter source data.

Local Ollama sends nothing off the device. With the customer's own cloud key the default is full content — their provider account, their data — and redaction modes (tokenised, locally summarised, or truncated) can be set globally or per source, each with a 'what gets sent' preview. Vrge Managed AI is floored to redact-by-default and can never transmit raw content.

AI-detected entities never write to the customer's database directly. Every observer-generated change requires explicit user approval through the Inbox.

Every accepted proposal can be undone within 24 hours via transactional rollback. The applied_proposals log records full snapshots for that purpose.

Each entity created via the observer carries an origin record: source event, AI model, confidence score, accept time. Auditable end-to-end.

Full export to portable JSON/CSV: entities, proposals, AI history, origin records. Works even with an expired license. No DRM, no lock-in.

Customer email, file, or business data is never submitted to any AI provider for training. Inference-only API calls, when authorised by the user.

All traffic between Vrge endpoints (website, license, auto-updater, Managed AI proxy) and customer devices uses TLS 1.2 or higher.

On the optional Team self-hosted server, user passwords are bcrypt-hashed with per-user salts. JWT for session management with rotation.

No Vrge-operated server retains a token; under a Team license they sit encrypted on your own server. For Gmail, Google Calendar and Outlook they never leave the device at all. Plaid, Stripe, Square and QuickBooks refuse to issue tokens to an app that cannot keep a secret, so a Vrge relay performs the exchange and refresh in transit — and for Plaid the token accompanies each read — storing neither.

The marketing site uses Cloudflare Web Analytics — aggregate page views and coarse geography only, no cookies, no fingerprinting, no personal identifiers.

Triage commitment within one business day of report. Public scope and rules of engagement on the Security page. Safe-harbour language for good-faith research.

Security & disclosure policy

Vrge has not commissioned a formal third-party penetration test. We do not claim one, and we will not display a badge we have not earned.

Required by Google for OAuth verification at restricted Gmail and Calendar scopes. Vrge completed a Tier 2 assessment with an authorised lab and passed with no security findings. Letter of Validation on file; available to enterprise buyers on request.

Vrge is not SOC 2 certified. We say so plainly rather than implying a posture we do not hold, and we will not display badges we have not earned.

Article 28 controller–processor template available. Standard Contractual Clauses (Module 2) incorporated. Sub-processor change notification with 30-day objection window.

Data Processing Agreement (DPA)

Privacy policy details CCPA categories of information collected. We do not sell or 'share' personal information as those terms are defined under CCPA.

Privacy Policy — California section

TRD Ventures LLC is not a HIPAA-covered entity, and Vrge is not a HIPAA-compliant system today. Customers in healthcare should not store, process, or transmit Protected Health Information through the Service.

Privacy Policy — HIPAA notice

Complete current list of third-party services that may process data on Vrge's behalf, with purpose, data categories, and jurisdiction for each.

Sub-processors

Vrge does not collect, transmit, or store payment card data. All payments are processed by Lemon Squeezy as Merchant of Record — they are PCI DSS Level 1 compliant.

Customer business data resides where the customer chooses — their device, their self-hosted server. Vrge-operated services run primarily in the United States; the marketing site is on Cloudflare's global network.