How we handle the data you contribute.

Summary

Verinode is the first independent data trust for Restoration. What that means in practice:

• ·Your data is yours. You can see it, export it and delete it at any time.
• ·We never sell your data to insurance carriers. Codified in our Terms of Service.
• ·Three purposes only. Running the product, anonymized peer benchmarks, and letting IQ learn what works. No AI model is trained on your data. Nothing else.
• ·Sensitive data stays encrypted under a key scoped to you. No other operator or carrier can read it, and only our audited systems ever decrypt it to run the product you asked for.
• ·Every contribution returns value. Anonymized aggregate contribution is the consideration for membership, and it earns you deeper access to the peer benchmarks it powers, a trade, not an extraction.
• ·Material changes require 30-day advance notice and your right to delete first.
• ·The Operator Advisory Council reviews material changes to this policy before publication, and its dissent is published if it disagrees.

The rest of this document is the detail.

What we collect

When you use Verinode, you give us access to three categories of data.

1. Business data

Data that describes how your restoration company operates:

• ·Jobs and claims: claim numbers, insured names, addresses, carriers, TPAs, categories, statuses, dates, amounts.
• ·Financial data: revenue, costs, margins, payment history, accounts receivable, cost profiles.
• ·Supplements: submitted, approved, denied amounts, reasons, response times.
• ·Vendors: who you buy from, what you pay, satisfaction ratings.
• ·Equipment, team members, certifications, safety records.
• ·Documents: the originals you upload (emails, PDFs, CSVs, photos) and the structured data extracted from them.

2. Interaction data

Pages you view and features you use are behavioral telemetry: contribution is opt-in and off by default. Separately, decisions you accept, reject or edit, chat and voice conversations with IQ and its specialist agents, survey responses, and corrections you make to extracted data are what IQ learns from (Purpose 3 below). What IQ learns from them stays in your account. Learning from your accept, reject and edit responses is on by default and revocable in Settings → Privacy.

A note on voice. When you talk to IQ instead of typing, your microphone audio is streamed to our speech-to-text provider (Deepgram) under a zero-retention flag, transcribed in flight, and discarded by the provider after the transcript is returned. Verinode stores the transcript on your chat log exactly as if you had typed it. The raw audio bytes are never retained by Verinode or by the provider. When IQ speaks back, only IQ’s typed reply is sent to the text-to-speech provider (OpenAI) for audio generation; your microphone audio never passes through OpenAI. Both providers are listed at verinode.ai/subprocessors.

3. Team contact information

Authorized user names and email addresses, role and permission assignments, and login history (for security auditing). We never use this for marketing outside of Verinode product updates you have opted into.

Connecting your mailbox

You can connect a Microsoft 365 (Outlook) or Gmail mailbox so carrier, TPA, vendor, and payment mail flows in automatically, instead of forwarding it by hand. This is optional. Email forwarding and direct upload remain fully supported, and you can disconnect at any time. When you connect a mailbox, these terms apply on top of everything else in this policy.

Read-only, by design

We request a read-only permission only (Microsoft Mail.Read, Google gmail.readonly). We never request, and the connection can never grant, the ability to send, reply, delete, move, or modify anything in your mailbox. We read mail; we do not act in it.

What we read, and what we skip

A mailbox connection is scoped, not a blanket read of everything you receive:

• ·You choose a folder or label. When you connect, you point us at one folder (Outlook) or label (Gmail), for example a folder named “Verinode” that you route carrier, TPA, and vendor mail into with a rule. We read only mail in that folder or label, nothing else in your mailbox. Connecting a dedicated mailbox such as [email protected] works the same way.
• ·If you do not choose a folder, we still do not process your whole inbox. A message is only analyzed when it carries a business document attachment (a PDF, spreadsheet, scan, or similar) or comes from a sender we already recognize as a carrier, TPA, or vendor. Everything else is left alone.
• ·A connected message is treated exactly like one you forward or upload. It flows into the same pipeline, under the same protections, encryption, and deletion rights described in the rest of this policy. It is never sold to insurance carriers, and no AI model is trained on it.

How the connection is secured

The access credential that lets us read your mailbox is encrypted at rest with our key-management service and is treated as our most sensitive class of secret. It is held only on our servers, never in your browser, and is used solely by the background process that reads new mail on the schedule you authorized. The mail itself is stored and protected under the same architecture as every other document you contribute, including Vault Key column-encryption of identifying fields.

Retention and one-click disconnect

You can disconnect a mailbox in one click, from the Integrations screen on web or mobile. Disconnecting stops all further reading immediately, revokes the access credential with the provider where the provider supports it, and removes our stored copy of it. Mail already ingested before you disconnect remains subject to your standard rights below, including export and deletion. Disconnecting a mailbox does not end your membership or your other data; it simply closes that one channel.

How we use it

Exactly three purposes. No others.

Purpose 1: Run the platform

Your raw business data powers the Verinode product you pay for: dashboards, signals, IQ advisory, decisions workspace, job-management intelligence, cost analysis, compliance tracking.

Purpose 2: Anonymized peer benchmarks

The analytical dimensions of your operational data feed cross-Operator benchmarks (carrier and vendor names, equipment models, dollar amounts, dates, categories). Your operator identifier is hashed with a keyed HMAC-SHA256 before reaching the intelligence layer, so no individual contributor can be identified. Identifying fields stay encrypted with your Vault Key and never leave your scope (see Protection below). The published cohort floor enforced in the Will-never list keeps small samples from leaking identity.

The benchmark is also protected from bad data. Figures that feed peer benchmarks are machine-extracted from your real documents and connected systems, not typed into a form, and a value with no verifiable origin is kept for your own analysis but excluded from peer cohorts. That origin gate, the distinct-Operator floor, the one-vote-per-Operator rule, and the median statistics that resist outliers are described in the published methodology.

These protections, together with the historical lag on sensitive figures and the fact that Verinode never recommends a price or a wage, are also how the benchmark is designed to stay on the right side of competition law. The design principles are explained in Antitrust and Fair Benchmarking.

Anonymized aggregate contribution is the consideration for membership. There is no toggle; ending it means ending the membership.

Purpose 3: Let IQ learn what works

IQ and its specialist agents (margin analyst, vendor economist, carrier-scorecard analyst, safety coach, and others) improve by keeping records in our database that IQ reads when it answers. No AI model is trained or fine-tuned on your data, by us or by anyone. What IQ learns from your conversations, corrections and preferences stays in your account; across the network, only the scorecard is counted: which recommendations worked and by how much, with no one identifiable. Frontier-model calls go to Anthropic and OpenAI under their standard paid API terms, which contractually bar training on our data, with all training and data-sharing toggles disabled in each provider’s console. They keep prompts and responses for up to 30 days to watch for abuse and misuse, then delete them, and longer only where the law requires it or a request is flagged for misuse. We do not have a zero-data-retention agreement with either. Learning from your accept, reject and edit responses is on by default and revocable in Settings → Privacy.

What we will never do

These commitments are built into our Terms of Service and cannot be changed without notifying you and giving you deletion rights first.

Sell raw business data to insurance carriers.

Not to primary insurers. Not to carrier-aligned data brokers. Not to any entity whose business model involves selling to insurance companies.

Expose your identity alongside your business metrics.

Benchmarks are aggregated and anonymized before they leave the PII database. The link back to your Operator account is severed via cryptographic hashing.

Share data with carrier-aligned analytics vendors or carrier subsidiaries.

Sharing with carrier-aligned third parties would defeat the structural purpose of the trust.

Publish benchmarks with cohorts smaller than 5 Operators.

Small cohorts risk identifying individual contributors through inference. 5 is the published minimum at national scope; 10 is the minimum for sensitive categories (financials, labor costs, profit margins).

Train an AI model on your data.

No AI model is trained or fine-tuned on your data, by us or by anyone. Frontier models from Anthropic and OpenAI answer your requests under their standard paid API terms, which contractually bar training on our data; your data is never added to any training corpus. The providers keep prompts and responses for up to 30 days to watch for abuse and misuse, then delete them, and longer only where the law requires it or a request is flagged for misuse.

Use your team members’ contact information for external marketing.

No lead-list resales. No partnerships with third-party vendors who want to pitch your team.

Change this policy without telling you.

Material changes are announced at least 30 days in advance with a summary of what is changing and why. If you disagree, you can delete your data before the change takes effect.

How your data is protected

The technical guarantees behind the commitments above.

Vault Key

Every operator account ships with a 30-character Vault Key, issued at sign-up and printed on your Membership PDF. The identifying parts of your data (customer names and contact details, claim numbers, your team’s personal information, full street addresses, free-text incident and supplement records, vehicle and equipment identifiers) are column-encrypted with this key. Verinode does not store the key in plaintext alongside your data. Your password unlocks your own day-to-day access; background processing uses a separate Verinode-managed key so our automated systems can run the product when you are offline. Every decryption is written to an immutable audit log, and no Verinode employee can browse or export your Vault-encrypted fields through any tool we operate.

The encryption uses a three-key envelope (server root key, Vault Key, user password) with scrypt and HKDF key derivation, AES-256-GCM column encryption. Every Vault session start and decryption attempt writes an immutable row to the Vault audit log.

Everything else

• ·All data is encrypted in transit (TLS 1.3) and at rest (AES-256-GCM).
• ·PII databases have row-level security enforced on every table with no authenticated access policies. All data access goes through service-role clients with explicit Operator scoping.
• ·Every change to our database is checked automatically before it ships. A change that would leave a table without row-level security, or open data to accounts that should not read it, is refused.
• ·Verinode staff access to Operator PII requires multi-factor authentication and is logged. Operators can request a complete access log for their account at any time.
• ·The software our application is built on is scanned automatically for known vulnerabilities, every week and whenever it changes.
• ·Any data incident affecting Operator data is communicated to affected Operators within 72 hours of discovery.

For the full security controls and sub-processor list, see verinode.ai/security and verinode.ai/subprocessors.

Your rights

Five concrete rights, exercisable at any time.

1. Hold the Vault Key.

The key issued at sign-up is yours. The mechanic is described in Protection above. Your right is to hold it, control session-time decryption, and revoke access by ending your membership.

2. Export your data.

All your Operator data, in CSV or JSON, at any time. No fees. No artificial delays.

3. Delete your data.

Processed within 30 days. Your records go from the PII database, along with every row in the intelligence layer that links your contributions to you, and from backup systems within 90 days. Live benchmarks are recounted without you. What was already published or decided stays as it was; we don’t rewrite history. Deletion cannot shorten the model providers’ own window: Anthropic and OpenAI keep prompts and responses for up to 30 days to watch for abuse and misuse, then delete them.

4. See what we have on you.

A complete report of what Verinode holds about your operation, what anonymized benchmarks include your contributions, and which Verinode team members have accessed your account in the last 90 days. Delivered within 14 days.

5. Turn off agent learning.

Settings → Privacy. On by default. Turn it off and your accept, reject and edit responses stop shaping IQ’s suggestions. Your benchmarks are unaffected, and aggregate benchmark contribution continues as membership consideration.

The full process for exercising any right (and for third parties named in operator-forwarded data) lives at verinode.ai/data-subject-request.

The Operator Advisory Council

Verinode is run by Verinode. The Council exists to keep this policy under operator-side scrutiny so the commitments stay honest as the company grows. The Council advises. It does not govern.

Composition. Five to nine appointed members. At least three Operator seats (current or recently active senior-Operator level). Up to two Industry Voice seats (Restoration-specialist lawyers, industry publishers, senior consultants, trade-association leaders). No Council member may simultaneously hold employment, equity, or paid advisory relationships with insurance carriers or carrier-aligned data vendors.

What the Council reviews. Material changes to this Data Use Policy before publication. The methodology behind benchmark and research outputs. Operator-side concerns about how data is being used or represented.

What the Council does not do.Approve or veto Verinode’s product roadmap, pricing, partnerships, or hiring. Sit on the board. Hold equity by virtue of membership.

Public reporting.Every quarterly meeting produces a public update within 30 days. An annual Council report each January covers meetings, recommendations, Verinode’s responses, and concerns raised. Unaddressed concerns are documented in the next public update alongside Verinode’s response. Where the Council disagrees with a Verinode decision, its dissent is published in full, not summarized or filtered before it reaches Operators.

Current roster and the full Charter: verinode.ai/council.

What you consent to at sign-up

The consent flow at sign-up has three explicit items.

1. Anonymized aggregate contribution (always on).

Aggregates from your operational data may be combined with other Operators’ contributions to produce peer benchmarks and research outputs, under the cohort floor and encryption rules described above. There is no toggle; ending it means ending membership.

2. Agent learning from response patterns (optional, default on).

Your accept / reject / edit responses shape IQ’s suggestions for you, and the outcomes are counted, with no one identifiable, in the network’s scorecard of which recommendations worked. No model is trained on them. Individual responses are never exposed. On by default; revocable in Settings → Privacy.

3. Public recognition as a contributing operator (optional, default off).

Your company name may appear in public lists of contributing Operators. Off by default. Your data remains in published benchmarks either way; this controls only whether your name is attached to the contributor list.

Jurisdictional notes

United States.

Verinode complies with state-level privacy laws (CCPA in California, similar laws in Colorado, Virginia, Utah, Connecticut, and others as they take effect). Where state law grants you additional rights beyond what is in this policy, those rights apply to you automatically.

European Union and United Kingdom.

Not currently supported. EU-region PII deployment and GDPR-specific protections ship before any EU operators are onboarded.

Canada.

Supported with PIPEDA-equivalent protections. The governing law for the Terms of Service and this Policy is Ontario, Canada. Verinode means Verinode Inc., and its Privacy Officer is accountable for its compliance with applicable privacy law.

Other jurisdictions.

Contact us. We will either confirm coverage under this policy or provide a jurisdiction-specific addendum.

Contact

• Data rights requests (export, delete, access report): [email protected]
• Data policy questions: [email protected]
• Operator Advisory Council: [email protected]
• Security incidents: [email protected]