Built for a low-trust market — so the guarantees are in the architecture.
Verlane is a security product sold to operators with no security staff. The promises below aren't marketing posture; most are code-enforced invariants.
The human gate is mandatory
Nothing irreversible — account reset, mailbox-rule removal, carrier block, counterparty notification — is ever executed automatically. The AI detects, investigates, and drafts; a human approves before anything happens. This is enforced in code, not convention.
Tenant isolation
Every record is scoped to its tenant. A customer user never reads or acts on another tenant's data — the multi-tenancy invariant is enforced at both the controller and model layers, and tested on the denial paths.
We never call a provider outside an adapter
Provider APIs are touched only by a dedicated adapter that normalizes data into a canonical event vocabulary. The engine consumes normalized events and never learns which provider produced one.
Least-data external delivery
Email and external alerts carry the headline, the plain-English narrative, and a link back to the app — never raw internals like IPs, addresses, or payloads. Authoritative detail lives only behind login and tenant RBAC.
Provenance and honesty
Insurance answers are labeled stated or derived; capability gaps are disclosed, not hidden. Every advisory artifact carries a versioned disclaimer that it is not a certified audit or a guarantee of coverage.
Secrets stay out of the repo
OAuth tokens and credentials live in encrypted configuration, never in source. Invites carry a link only — single-use, expiring, and stored as a digest, never a secret in an email body.
Start with the paperwork your insurer already wants — free.
Get a security posture report and a pre-filled cyber-insurance questionnaire in plain English. No provider connection required, no incident needed to prove value.