Privacy, Security, and Troubleshooting
Verification AI (VerAI) is a server-side cybersecurity analysis application that combines technical inspection, threat intelligence, and external analysis services. This page explains how information is processed, VerAI's stated privacy commitment, the role of third-party providers, and common troubleshooting considerations.
Our Data Privacy Commitment
VerAI does not sell your data.
VerAI processes information submitted by users to provide its cybersecurity analysis and verification features.
Depending on the selected analysis, the application may communicate with external security intelligence providers, AI services, DNS infrastructure, and other technical services.
This communication enables the requested analysis.
Using third-party services to perform an analysis is different from selling user information.
External service providers may process information according to their own privacy policies and terms.
VerAI's commitment not to sell data should not be interpreted as a promise that submitted information will never be transmitted to an external provider.
How VerAI Processes Information
VerAI uses a Flask backend to receive submitted data and execute the selected analysis.
Processing Overview
| Input | Processing |
|---|---|
| Website | Server-side network checks and external AI services |
| File | SHA-256 calculation and VirusTotal lookup or submission |
| Phone | Phone number validation and geographic metadata |
| DNS MX lookup and WHOIS domain age | |
| IP Address | DNSBL, reverse DNS, geolocation, and GreyNoise requests |
Results are returned through a server-rendered results page.
Third-Party Service Integrations
VerAI uses external services where necessary to support its analytical functionality.
| Service Category | Purpose |
|---|---|
| AI Providers | Generate website security observations |
| VirusTotal | Retrieve file reputation information and perform file analysis |
| Google Safe Browsing | Identify known URL threat matches |
| GreyNoise | Provide IP intelligence and classifications |
| IP Geolocation | Estimate geographic information for IP addresses |
| DNS Services | Retrieve domain and network records |
| WHOIS Services | Retrieve domain registration metadata |
| Target Website Infrastructure | Respond to network and security configuration checks |
External Data Processing
The information transmitted depends on the operation requested.
For example:
- A website URL may be submitted to AI and security intelligence services.
- A file hash may be submitted to VirusTotal to retrieve a reputation report.
- A file may be submitted to VirusTotal for analysis.
- An IP address may be queried through GreyNoise and geolocation providers.
- Domain names may be queried through DNS and WHOIS services.
These activities support VerAI's functionality.
They are not, by themselves, evidence that VerAI sells user data.
Third-Party Policies
External providers operate under their respective terms and privacy policies.
Their data collection, processing, retention, and sharing practices may differ from those of VerAI.
Users should consider these practices when submitting sensitive information.
Handling Sensitive Information
VerAI can process security-related information, but users should consider what they submit.
Website URLs
Avoid submitting URLs containing sensitive tokens, credentials, or private access parameters.
Files
File analysis may involve submission of file contents to VirusTotal.
Consider whether external analysis is appropriate before submitting confidential files.
Phone Numbers and Email Addresses
VerAI processes submitted phone numbers and email domain information to provide the selected checks.
Submit personal information only when appropriate and authorized.
IP Addresses
IP analysis may involve queries to external security intelligence and geolocation services.
Security Controls
The supplied Flask application configures selected security features.
Secure Session Cookies
| Setting | Value |
|---|---|
| SESSION_COOKIE_SECURE | True |
| SESSION_COOKIE_HTTPONLY | True |
| SESSION_COOKIE_SAMESITE | Lax |
These settings apply to Flask session cookies where used.
Flask-Talisman
The application initializes Flask-Talisman.
Its configuration explicitly disables Talisman's Content Security Policy setting.
A CSP should therefore not be assumed to be enforced through that configuration.
Rate Limiting
The source includes Flask-Limiter and declares a limit of:
10 requests per minuteActual enforcement depends on the deployed application's configuration, routing, and proxy setup.
Bot Filtering
The application includes a user-agent-based blocklist for selected web crawlers.
User-agent strings can be changed or spoofed, so this mechanism is not a substitute for stronger abuse prevention.
Troubleshooting Website Analysis
Website Cannot Be Resolved
Possible causes include:
- Incorrect hostname
- DNS configuration problems
- Unavailable domain
- Temporary DNS failures
Check the spelling and accessibility of the submitted website.
TLS Information Is Unavailable
The server may not accept TLS connections on port 443, or certificate validation or connection establishment may fail.
A failure does not necessarily establish that the website is malicious.
Security Headers Are Missing
The website may not set the requested headers.
Some headers may be intentionally omitted depending on application requirements.
Review findings in context.
WHOIS Lookup Fails
WHOIS availability varies by registry and registrar.
Registration information may be redacted or restricted.
Safe Browsing Returns an Error
The external API may be unavailable, its credentials may be invalid, or the request may be rejected.
An error is not equivalent to a safe result.
SSH Inspection Fails
The website may not provide SSH on port 22, or a firewall may block the connection.
SSH inspection is not an exhaustive service scan.
Troubleshooting AI Assessments
AI Response Is Unavailable
Possible causes include:
- API authentication errors
- Unsupported model identifiers
- Provider outages
- Network timeouts
- Usage quotas
- API compatibility problems
The AI integrations depend on external provider availability.
AI Assessment Contradicts Technical Results
AI output may contain unsupported inferences.
Compare observations with concrete technical evidence before drawing conclusions.
Troubleshooting File Analysis
No Existing VirusTotal Report
The file may not have an existing record, or the API request may have failed.
The application may attempt a new scan.
File Analysis Takes Too Long
Processing may depend on file size, external service responsiveness, and VirusTotal scanning time.
VirusTotal Returns an Error
Possible causes include credentials, permissions, rate limits, or service problems.
An error does not establish that the file is safe.
Troubleshooting Phone Verification
Phone Number Is Rejected
The submitted implementation expects a US number with 10 digits or 11 digits beginning with 1, after formatting characters are removed.
The number must also pass the numbering library's validity checks.
Carrier Information Is Missing
Carrier lookup is not implemented in the active response.
Troubleshooting Email Verification
MX Records Are Missing
The domain may not publish accessible MX records, or the lookup may have failed.
Domain Age Is Unavailable
WHOIS information may be incomplete, redacted, or returned in an unexpected format.
Email Address Is Not Confirmed
The application does not perform mailbox ownership verification.
Troubleshooting IP Intelligence
DNSBL Results Are Incomplete
Some providers may time out, reject queries, or no longer support the configured DNSBL endpoint.
GreyNoise Returns an Error
Verify the service's availability and whether valid credentials are configured.
Reverse DNS Is Missing
Not all IP addresses have configured PTR records.
Geolocation Is Unexpected
IP geolocation is approximate and may identify hosting or network infrastructure rather than an end user's location.
Known Limitations
| Area | Limitation |
|---|---|
| Website Analysis | Point-in-time checks, not a complete security audit |
| TLS | Single negotiated connection rather than full configuration enumeration |
| Website AI | URL-focused prompts rather than analysis of all technical results |
| AI Providers | Depend on external services and compatible APIs |
| File Reputation | Depends on VirusTotal |
| Phone Verification | US numbering validation, not subscriber identity |
| Email Verification | MX and domain age, not mailbox existence |
| IP Analysis | Primarily IPv4 |
| DNSBL | Limited configured providers and recognized response codes |
| Geolocation | Approximate country information |
| Rate Limiting | Deployment behavior must be verified |
Responsible Usage
Use VerAI for authorized investigations and preliminary security assessment.
Do not treat an AI observation, reputation-list entry, or missing configuration header as conclusive proof of malicious intent.
For high-stakes decisions, corroborate findings using independent technical evidence and qualified security review.
Reporting Issues
When reporting a VerAI problem, include:
- Analysis type
- Browser and operating system
- Relevant nonsensitive input
- Error message
- Approximate time of the request
- Steps needed to reproduce the issue
Do not include passwords, confidential files, API credentials, or private access tokens.
Final Reminder
VerAI combines multiple sources of technical and reputation intelligence to support cybersecurity investigations.
The application's stated commitment is that VerAI does not sell user data. Certain features nevertheless use external providers to carry out requested analyses.
These are distinct aspects of how the service operates.
Verification is a process, not a single score.
Use VerAI's results to guide further investigation, not as an unconditional guarantee of safety.
Updated 8 days ago