Trust Centre

What we do, what we do not do, and where the detail lives. We describe how our products work rather than make general assurances, and we say plainly what we have not published.

Operated by WASIFIC PTY LTD.

Security approach

Accounts and sign-in: Verexa passwords are stored only as a protected one-way hash, never in readable form. Sign-in attempts are rate-limited and may be temporarily refused after repeated failures. Security-relevant actions, such as completing a password reset or connecting a sign-in method, are recorded in audit logs.
Verifiable downloads: The Verexa Secure Browser installer is published with a SHA-256 hash so you can verify the file you downloaded. The installer is not code-signed; the hash is how its integrity is checked, and we describe it that way rather than implying otherwise.
Hosting: This website is hosted on Vercel.

Privacy approach

Our approach: We aim to handle personal information in line with privacy-by-design practice and, where they apply to us, Australian privacy law and the Australian Privacy Principles. This describes how we work; it is not a claim of certification or of any particular regulatory status. We do not sell personal information and we do not use it for advertising.
Where the detail lives: The Privacy Notice is the authoritative description of what we collect and why. This page summarises it and does not replace it.

Human review, not automated judgement

Verexa does not decide misconduct: Verexa records review signals for authorised staff. It does not automatically determine that anyone has cheated; the institution's authorised reviewers make that decision.
What Verexa does not do: Verexa does not record or store video of a student or their screen, does not record audio during an assessment, and does not use face recognition or any biometric identification.

Data handling and evidence

Optional features are off unless enabled: Camera-based and screen-based features are optional, are off unless an institution enables them for a particular assessment, and students are shown a notice describing what is collected before they begin.
Retention: The institution decides which assessments are run, which optional integrity features are enabled and how long its records are kept. Short-lived technical records, such as password-reset links, expire automatically.
Optional AI features: Verexa has optional AI features. When one is used, the relevant content is sent to an AI model provider (Anthropic) to produce the result, as described in the Privacy Notice. Verexa does not add student names, email addresses or student numbers to what it sends.

Operational responsibilities

Institutions and Wasific: Institutions are responsible for their own student notices and for how they configure assessments. Wasific operates the platform and handles the information described in the Privacy Notice. Seviact is provided under its own customer agreement and privacy terms; this page does not describe Seviact data handling.

Service providers named in our Privacy Notice

Providers: The providers currently named in the Privacy Notice are listed below. This list reflects the Privacy Notice and is not presented as a complete subprocessor register.
Vercel — hosts the Verexa web application and this website
Supabase — hosts the Verexa database and a private file store for evidence images, where an institution enables them
Resend — delivers account emails such as password-reset links
Anthropic — optional AI features in Verexa, only when one is used
Google — only when a user chooses Google sign-in
GitHub — hosts the Verexa Secure Browser installer file

Not published

Third-party security certifications or audit reports. None are currently published; any that are obtained will be listed here with their scope.
A complete subprocessor register.
Service-level and support-hours commitments. None are published on this website.

Contacts

Security concerns and incident reports: support@wasific.com
Privacy requests: privacy@wasific.com

See also the Privacy Notice and Terms of Use.