How veriQU handles your data
Last updated: October 29, 2026
veriQU is a software-as-a-service product sold by The Cloud Catalysts through AWS Marketplace. It runs read-only assessments of AWS accounts that a subscriber chooses to register. This page describes what data veriQU collects, where it is stored, how it is used and shared, how long it is kept, and how it is backed up.
1. What we collect
| Data | Where it comes from |
|---|---|
| Your AWS Marketplace customer identifier, the AWS account that subscribed, and the product code | AWS Marketplace, when you subscribe |
| Your contract entitlement (number of accounts, expiry) | AWS Marketplace, checked hourly |
| Your first and last name, company, optional role, and a contact email | You, on the registration page after you subscribe |
| Your email address and password for the veriQU console | You, when you create a login (the password is held by Amazon Cognito; we never see it) |
| The AWS account IDs, regions, role ARNs and (optionally) the fulfillment URL you register for assessment | You, in the console |
| Your answers to the items only you can answer, with the name you give and the sign-in email of the person answering | You, in the console |
| If you ask us for a penetration test: the application address, environments, preferred dates, contact name, email and phone, and any notes you add | You, in the console |
| Configuration metadata from the accounts you register | veriQU's scan, through the read-only role you deploy |
What a scan reads. The role you deploy grants AWS's SecurityAudit and ViewOnlyAccess managed policies plus a small read-only supplement, and it explicitly denies reading stored data: S3 objects, DynamoDB items, Secrets Manager secret values, Parameter Store values, KMS decryption, SQS messages and Lambda code. A scan sees how your account is configured, not what is stored in it. Some configuration can itself contain sensitive values (for example a password placed in a Lambda environment variable). veriQU reports that such a value exists so you can move it; it does not copy the value into your report.
What we never collect. Payment details of any kind. All billing runs through AWS Marketplace.
2. Where it is stored
Everything runs in The Cloud Catalysts' AWS account in the US East (N. Virginia) region (us-east-1). No data leaves AWS.
| Store | Contents | Protection |
|---|---|---|
| Amazon DynamoDB tenant registry | Subscription, entitlement, registered accounts, scan status | Encrypted with a customer-managed KMS key (rotation on); point-in-time recovery; deletion protection |
| Amazon Cognito user pool | Console login (email, hashed password) | Managed by AWS; MFA available |
| Amazon S3 results bucket | Your scan findings and reports, under a prefix only your subscription can reach | KMS-encrypted; not public; access only through short-lived signed links issued to your authenticated session |
| Amazon CloudWatch Logs | Application logs, with secrets and signed links redacted | Encrypted; kept 400 days |
| AWS CloudTrail audit bucket | Record of API activity in our account | S3 Object Lock, 366-day retention |
3. How we use it
Only to provide veriQU to you: checking your entitlement, running the scans you request, producing your reports and remediation templates, and contacting you about your subscription, a penetration test you asked us for, or a security incident. We do not use your data for marketing, advertising or model training, and we do not sell it.
4. Who we share it with
No one, except:
- AWS, as the infrastructure provider and as AWS Marketplace, which handles your subscription and billing.
- When the law requires it.
veriQU uses no third-party analytics, error tracking or monitoring services.
5. How long we keep it
| Data | Kept |
|---|---|
| Scan findings and reports | 90 days, then deleted automatically (a deleted report stays recoverable by us for up to 30 more days, then is gone) |
| Subscription record, console login and any remaining reports | While you are subscribed, then deleted automatically 30 days after your subscription ends |
| A penetration test request | On your subscription record until you send a new one or that record is deleted; the copy emailed to us is kept as business correspondence |
| Application logs | 400 days (they record activity, not your findings; they name your subscription only by its Marketplace customer identifier, which stays in logs written before deletion) |
| Audit trail of our own account | At least 366 days, tamper-protected |
Deletion on request. Email info@thecloudcatalysts.com from the address on your subscription. We delete your subscription record, console login and all stored reports within 30 days and confirm by email. Records we must keep by law, and the immutable audit trail of our own account, are excepted. Deleting the role stack in your own account removes veriQU's access to it immediately.
6. Backup
The tenant registry has point-in-time recovery for the last 35 days, and a daily backup copied to a second AWS region (US West, Oregon), kept 35 days. Reports are not backed up: they expire after 90 days and any report can be regenerated by running a new scan. Backups are encrypted and stay in AWS.