Security, honestly stated. Limitations included.

Data handling

• Every uploaded video is stored in a private, org-scoped object storage bucket. Only signed URLs are ever served.
• Row-level security scopes every database read to the requester's organization. Cross-tenant reads are impossible at the database layer.
• API keys are hashed at rest. The full key value is shown once at creation and never again.
• All privileged actions (verdict overrides, key creation, membership changes) are written to an immutable audit log.

What our detectors do well

• Catch commodity face-swap and lip-sync tools - most published deepfake generators leave detectable frame or temporal artifacts.
• Flag re-encoded or metadata-stripped video, which is a strong prior for tampering in KYC contexts.
• Verify signed content credentials (C2PA) when present.

What we can't guarantee

• A state-of-the-art bespoke generator, given enough compute and no time pressure, can defeat any single detector we run - including ours. That's why we run six.
• Very short (<3s) or very low-quality clips give any detector less signal to work with. Confidence bands reflect this.
• Live-stream detection is out of scope in v1; VerifAI targets pre-recorded video.

How to use it well

Treat VerifAI as one control in a defense-in-depth stack: pair it with liveness challenges, device signals, transaction risk scoring, and - for anything high-value - a trained human reviewer looking at the evidence page we produce.

Frameworks we're built to exceed

The certification programme runs in the open. Every framework below is tracked with evidence bindings back to real platform artefacts, and gaps are published with owner and due date on the compliance portal.