Docs
ES

Authentication

API key

Your API key is a string with a brand prefix (veriko_) followed by 64 randomly generated hexadecimal characters. It is used to sign the actions you perform on the platform. On the server it is stored fully encrypted (never in plaintext) and is only shown ONCE when you generate it.

Full detail at: API authentication

Handling of sensitive data

Account numbers (CLABE, card, phone)

Beneficiary accounts are stored in user_beneficiaries.account_number and inside the request_data JSON of each validation. We do not encrypt them at the column level.

Uploaded images

The images you upload go through a sanitization process before touching the main server. It is important to keep them in mind for any request:

  1. Size: 40 bytes minimum, 12 MB maximum.
  2. Format: JPEG/PNG/WebP only.
  3. Cross-check of the MIME type.
  4. Structural parse: dimension caps (12000 px per axis, 60 megapixels total).
  5. Polyglot scan: rejects malicious payloads.
  6. Metadata removal: EXIF, XMP, ICC profiles, text chunks (PNG), VP8X chunks (WebP), etc.
  7. Among other security mechanisms.

For images fetched via image_url, the egress is hardened: HTTPS-only, HTTP with SSRF and DNS protection, limited redirects, strict SSL certificate verification, an in-stream monitored size cap, among other security mechanisms.

Outgoing webhooks

The events we send to your endpoints are signed with HMAC-SHA256 over the JSON body, using a per-endpoint secret that you generate and rotate in the panel. The signature ships in:

X-Webhook-Signature: sha256=<hex>

Full detail at: Webhook architecture.

Retention

These are Veriko's retention times in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP):

  • OCR receipts: 30 days. Orphan files are swept periodically.
  • idempotency_keys: Hourly (per-scope TTL, 24h for validations).
  • otp_codes: Expired OTPs are removed hourly.
  • notifications and notification_deliveries: Daily cleanup.
  • telegram_link_tokens: Hourly.
  • webhook_ingress_events.raw_payload: 30 days.
  • audit_log: 1 year.

Validations (validations) and beneficiaries (user_beneficiaries) have no automatic retention — they are your history and remain until you explicitly delete them.

Compliance support

If your team needs to coordinate a security review, a vendor questionnaire (vendor assessment), a data processing agreement, or an erasure request via an end user, contact the security team through the channel listed in your contract.

If your process requires SOC 2, ISO 27001, or another formal attestation, ask about the current status before integrating.