Protection Architecture · Zero Trust by Design

Protection
by design.

BYOK encryption. Physical isolation. Network controls. Compliance documentation.

One cluster. One team. One contract. Zero shared tenancy — protected by architecture, not by policy.
Data SovereigntyModel SovereigntyCompute SovereigntyGovernance Sovereignty
BYOK EncryptionPhysical Isolation4-Eyes PolicyAudit Trail21-Policy InsuranceNo Best-Efforts ClauseIE-Certified MilestonesSurety Bond Backed
Security Architecture

12 layers of institutional protection.

Every layer is contractual. Every layer is active at go-live. No layer is optional.

Threat Model

Six threat vectors.
Six architectural responses.

Each identified threat vector has a dedicated architectural countermeasure — not a policy statement. Implemented at go-live. Contractually committed.

VectorThreatSeverity
01Physical BreachCritical
02Data ExfiltrationCritical
03Financial FraudHigh
04Insider ThreatHigh
05Supply Chain AttackHigh
06Nation-State AttackCritical
Critical

Physical Breach

Unauthorized physical access to dedicated compute hardware

Layered Physical Security

  • Dedicated biometric-locked cage — not shared open floor
  • 3-Factor entry: fingerprint + PIN + badge + man-trap double door
  • 4-Eyes Policy: minimum 2 authorised personnel for all cage access
  • 90-day CCTV retention — reviewed on all security events
Critical

Data Exfiltration

Theft or leakage of model weights, training data, or workload output

BYOK + Hardware TEE + NIST Erasure

  • AES-256-GCM at rest — TLS 1.3 in transit
  • Bring Your Own Key — Verde holds zero decryption capability by design
  • Hardware-native Trusted Execution Environment: silicon-level isolation
  • NIST SP 800-88 media sanitization — certificate within 30 business days
High

Financial Fraud

Misappropriation of client funds or pre-paid engagement fees

7-Tier Escrow Waterfall

  • Client funds in institutional trustee escrow — never Verde corporate cash
  • Contractually fixed waterfall: senior obligations → operating costs → structural reserves → Verde distributions
  • Monthly independent CFO review and Corporate Trust Officer oversight
  • Verde cannot distribute equity until all prior tiers — including Contingency Reserve — are satisfied
High

Insider Threat

Malicious or negligent action by Verde or facility personnel

Zero-Trust Access + Continuous Logging

  • 4-Eyes Policy: no single engineer has unilateral cage or system access
  • Every Verde engineer session logged in real time — visible to client security team
  • Zero Trust NOC: identity-verified per session — no persistent or implicit remote access
  • OFAC-screened, background-checked personnel on every engagement
High

Supply Chain Attack

Compromised hardware components entering the compute stack

EAR-Compliant Authorised Sourcing

  • Hardware sourced exclusively through manufacturer-authorised, EAR-compliant channels
  • No grey-market or non-authorised reseller procurement — zero exceptions
  • OFAC screening applied to all hardware suppliers and transactions
  • Full supply chain documentation available to client on request
Critical

Nation-State Attack

Sophisticated state-sponsored cyber intrusion targeting AI infrastructure

Hardware TEE + Zero Trust Architecture

  • Hardware-Native TEE: compute isolation enforced at silicon level — not software policy
  • Zero Trust NOC: no persistent remote access, session-by-session identity verification
  • DDoS mitigation active at network edge — 24/7 Managed SOC monitoring

Nation-state cyber attacks are excluded from all commercial cyber insurance policies globally — a cross-market syndicate mandate that applies to every commercial insurer, not just Verde’s consortium. Verde discloses this clearly. Verde’s countermeasure is architectural: Hardware TEE + Zero Trust NOC, both active by default.

Security Architecture

Protection in four dimensions.

Encryption. Physical control. Network isolation. Compliance by design. Each dimension is independently enforced — not a single point of failure.

01Encryption6 controls
02Physical5 controls
03Network6 controls
04Compliance7 controls
01Encryption

Encryption at Every Layer

Verde cannot decrypt your storage contents under any circumstance — by architectural constraint, not policy.
  • BYOK — Bring Your Own KeyHardware-backed key storage. Verde holds no decryption capability. Key management remains entirely within your security boundary — from day one.
  • AES-256-GCM at Rest · TLS 1.3 in TransitAll data at rest encrypted with AES-256-GCM. All data in transit encrypted with TLS 1.3 — no protocol downgrade permitted.
  • Hardware Security Module (HSM) OptionHSM-backed key storage available for clients requiring hardware-rooted key custody. Zero plaintext key exposure at any layer.
  • Automated Key RotationScheduled key rotation without service interruption. All rotation events logged with timestamp and audit trail.
  • Hardware-Enforced TEE — GPU Compute IsolationModel weights, activations, and training gradients are encrypted inside the hardware-enforced Trusted Execution Environment at the GPU layer. Verde engineers see cluster telemetry only — compute-layer data is architecturally inaccessible to Verde staff, not protected by policy.
  • Post-Quantum Cryptography — NIST FIPS 203/204/205Verde provides a Post-Quantum Cryptography Readiness Assessment at engagement initiation against NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). BYOK architecture supports algorithm replacement without re-encrypting client data at rest — documented in the MSA Cryptography Schedule.
02Physical

Physical Isolation

Your hardware. Your cage. Your lock. No shared floor, no shared access, no exceptions.
  • Dedicated Private Cage — Not SharedDedicated full-cage private space — biometric-locked. No other Verde client, no shared open floor, no third-party rack access.
  • 3-Factor Biometric + Man-TrapFingerprint + PIN + badge (3-factor). Man-trap double-door entry eliminates tailgating. Every access attempt is logged.
  • 4-Eyes Policy — MandatoryMinimum 2 authorized personnel required for all cage access. Single-person entry is architecturally blocked — not just a policy.
  • 90-Day CCTV + Client-Authorized Visitor Escort24/7 on-site security personnel. 90-day CCTV retention. Verde-authorized visitors escorted within 2 hours of advance notice.
  • AI-Native Artifact Isolation — Model Weights Storage SegmentAI model weights, training datasets staged for fine-tuning, and checkpoint files require a physically isolated storage segment distinct from operational compute and networking systems. Within Verde's dedicated cage, AI artifacts are stored on isolated, physically segmented storage nodes accessible only through the secure GPU compute enclave — not through general-purpose operational interfaces. This means Verde's NOC cannot read or copy model weights even with full cage access: the physical storage segment is accessible only through the hardware-enforced TEE layer. Hardware-isolated artifact storage prevents the most common class of AI IP loss events — operational access with data exfiltration — by design, not by policy.
03Network

Network Controls

Your traffic never shares a routing path with another client. Zero Trust enforced at every session boundary.
  • Dedicated Private VLANEach client operates on a dedicated private VLAN. No shared routing path. No cross-client traffic visibility at any layer.
  • Zero Trust FirewallIdentity-verified access for every session. No implicit trust by network position. All traffic inspected and logged.
  • High-Bandwidth Dedicated FabricNo public network exposure for compute traffic. High-bandwidth dedicated fabric with no contention from other tenants.
  • DDoS Mitigation — Always-OnVolumetric scrubbing at network edge. Always-on protection. Optional: dedicated fiber/MPLS to client HQ — latency SLA negotiated per engagement based on physical topology.
  • AI Workload Traffic Isolation — Layer 3 SegmentedAI inference traffic, model training I/O, and Verde NOC management traffic operate on physically separate Layer 3 network segments. Bandwidth contention between training and inference workloads is architecturally prevented — not managed by QoS policy.
  • Network Telemetry — Real-Time SOC IntegrationFull network telemetry — session logs, ingress/egress policy events, and anomaly alerts — is fed to the 24/7 Managed SOC in real time. No network event occurs outside the monitoring perimeter. Client security teams receive direct access to network event dashboards.
04Compliance

Compliance by Architecture

Infrastructure designed to support your compliance obligations — not just Verde's.
  • Dual-Tier SOC 2 Architecture & Relative MSA TimelineVerde Compute, Inc. (Holding) commits to a Master SOC 2 Type II audit programme, which begins at contract execution, covering 24/7 NOC/SOC, PAM, and SIEM infrastructure. Each client SPV LLC receives an automatic Scope Extension Bridge Letter (T+30 Days) and annual re-attestation (T+365 Days), eliminating static calendar deadlines and providing instant client audit compliance.
  • EU AI Act Article 12 — Logging Capability (High-Risk AI)EU AI Act Article 12 (Regulation (EU) 2024/1689) requires providers and deployers of high-risk AI systems to implement automatic logging of events for the duration of the system lifecycle. Verde's infrastructure is architecturally compatible with these logging requirements. SIEM, PAM, and inference telemetry logs are stored in immutable, tamper-proof storage separate from operational systems — Verde cannot alter or delete audit records. All logs are client-accessible and exportable for regulatory submission. Article 13 (transparency to deployers) obligations are also addressed: clients receive the Sovereignty Control Matrix and monthly infrastructure reports. This architectural property is only achievable on dedicated infrastructure: multi-tenant providers cannot deliver per-client immutable audit trails.
  • Quarterly Scope 2 Carbon Report — CSRD / ISSB ReadyVerde delivers a quarterly Scope 2 carbon report — WREGIS certified, audit-ready for CSRD, ISSB S1/S2, and equivalent regulatory frameworks. Includes facility PUE disclosure and renewable energy certificate verification. Clients subject to ESG reporting obligations receive documentation submittable directly to their sustainability auditors.
  • No Best-Efforts Clauses — Surety Bond BackingVerde's MSA contains no "best efforts" or "commercially reasonable efforts" clauses. All performance and availability obligations are contractually absolute. If Verde fails to deliver, the Surety Bond (L14) provides direct client recovery — not a service credit negotiated after the fact. This is the structural difference between a contractual commitment and a policy aspiration.
  • Shadow AI Firewall Certificate2026 enterprise survey data indicates that fewer than 5% of organisations have full visibility into AI tool usage across their workforce — and that unsanctioned AI tools were a contributing factor in a significant share of breach incidents among affected organisations. For organisations deploying proprietary AI infrastructure, the boundary between sanctioned AI (running on Verde's dedicated cluster) and unsanctioned AI (consumer tools used by employees) must be architecturally documented, not merely stated in policy. Verde's Shadow AI Firewall Certificate documents the technical controls preventing Verde-hosted models from receiving data ingestion from unsanctioned sources: network-layer isolation, VLAN segmentation, and ingress traffic classification. This certificate is relevant for CISO AI governance programmes and increasingly for cyber insurance underwriting.
  • AI Liability Shield — Infrastructure-Layer Evidence PackageWhen AI systems produce harmful outputs, liability attribution requires evidence of the infrastructure environment in which the system operated. Verde's AI Liability Shield is a documentation package assembled at engagement initiation and updated quarterly: Independent Engineer-certified infrastructure state records, Flight Recorder Archive access rights, Hardware Provenance Passport, Post-Deployment Behavioral Baseline certificate, and the 21-policy insurance consortium certificate with client Additional Insured status. This package does not prevent liability claims — it ensures that if a claim arises, the infrastructure layer is independently documented and the client has direct insurance recovery rights rather than solely contractual remedies against Verde.
  • AI Insurance Readiness DocumentationAI-specific cyber insurance underwriting has become a distinct underwriting category. Insurers underwriting AI system risk require documentation of: the infrastructure environment in which the AI operates; data provenance and access control documentation; audit trail architecture; and the vendor's own insurance programme and financial backstop. Verde assembles a structured AI Insurance Readiness Package for each client: Verde's 21-policy consortium Certificate of Insurance, the client's Additional Insured endorsements, the IE-certified Go-Live Certificate, the Flight Recorder access commitment, and the Hardware Provenance Passport. This package is specifically formatted for submission to the client's own cyber and technology liability insurance underwriter — not a generic compliance document.
· SOVEREIGNTY CONTROL MATRIX ·

Every control.
Every engagement.

29 security controls. Independently enforced. Contractually committed. Not a checklist — an architecture.

Lender's Protection
  • First loss payee on all asset policies
  • Surety bond sized per engagement
  • Independent milestone certification
2 dedicated financial controls
Verde Coverage
  • 21-policy institutional consortium
  • Business Interruption — full engagement term
  • Emergency Cloud at Verde's cost
29 total controls · 26 contractually active
Client Additional Insured
  • Named on Cyber, CGL, and E&O policies
  • Certificate of Insurance on request
  • Direct rights under the policy
Direct policy rights — not solely contractual claims

26 controls are contractually committed in every MSA.3 available at engagement initiation.All are independently enforceable — not policy statements.

ControlImplementationScopeFrameworksStatus
Encryption at Rest
AES-256-GCM · BYOK-capable · hardware-backed key storageAll client data
SOC 2GDPRHIPAAISO 27001
Active
Encryption in Transit
TLS 1.3 mandatory · no protocol downgrade permittedAll sessions
SOC 2GDPRHIPAA
Active
Physical Access Control
3-factor biometric · 4-Eyes Policy · man-trap double-door entryCage entry
SOC 2ISO 27001
Active
Network Isolation
Dedicated private VLAN · Zero Trust firewall · no shared routingAll client traffic
SOC 2ISO 27001DORA
Active
Access Control (IAM)
Role-based · MFA enforced · least-privilege · no standing accessAll Verde personnel
SOC 2ISO 27001DORA
Active
SIEM & Monitoring
24/7 enterprise-class managed SOC · continuous telemetry · automated alertingFull stack
SOC 2ISO 27001EU AI Act
Active
Incident Response
P1 <2hr client notification · P2 <4hr · P3/P4 next business day · Post-Incident Review within 5 business days · Semi-annual tabletop exercisesAll severities
SOC 2ISO 27001DORA
Active
Key Management
BYOK · HSM option · automated rotation · Verde holds no decryption keysEncryption keys
SOC 2GDPRHIPAA
Active
Client IP Ownership
Zero Verde access to models, training data, or workload outputs · guaranteed in MSA · no platform license carveout · no training data reservation · no residual weight retentionAll workloads
GDPRCCPAEU AI ActDORA
Active
Sanctions & Supply Chain Compliance
OFAC sanctions screening — all Verde personnel and transactions · Hardware sourced through EAR-compliant, manufacturer-authorised channels with documented chain of custodyAll personnel, transactions & hardware procurement
OFACEAR
Active
Confidential Computing
Hardware-Native TEE (Trusted Execution Environment) — model weights and activations protected at hardware level, inaccessible to host OS and Verde NOC by architectureAvailable to all clients
EU AI ActGDPR
Available
Fire Suppression
Clean-agent system only — no water-based suppression in compute areas · annual licensed engineer inspection certificateCompute hall
SOC 2ISO 27001
Active
Cyber Resilience
Emergency Cloud Compute auto-activation upon any primary cluster unavailability · Business Interruption insurance-backed · at Verde's costAny outage event
SOC 2DORA
Active
Vendor Integrity & Hardware Provenance Passport
Hardware sourced exclusively through manufacturer-authorised, EAR-compliant channels. Hardware Provenance Passport delivered at Financial Close: OEM source attestation, manufacturing lot reference, transit chain documentation, serial number registry, and supply chain compliance confirmation. GPU-level compliance reporting available for regulated-industry clients on request.All hardware
ISO 27001EAR
Active
Engineer Access Logging
PAM-enforced · every Verde engineer session logged · time-limited credentials · real-time client-visible access logAll Verde engineer activity
SOC 2ISO 27001EU AI Act
Active
Vulnerability Management
Monthly vulnerability scans · Annual penetration test (external + internal) · Critical CVE: 48-hour remediation · High CVE: 7 days · Pen test results available under NDAFull stack
SOC 2ISO 27001DORA
Active
Hardware Attestation
GPU-level provenance documentation available for regulated-industry compliance reportingAvailable on request
ISO 27001EAR
Available
Data Residency Control
All client data processed and stored exclusively within Pacific Northwest colocation infrastructure. No cross-border data movement. Geographic containment documented in MSA Data Processing Schedule and DPA. Applicable to DORA (EU financial entities), GDPR Article 46, and equivalent data sovereignty frameworks.All data at rest and in transit
GDPRDORAHIPAA
Active
Media Sanitization — Engagement End
NIST SP 800-88 cryptographic and physical sanitization of all storage media at engagement end. Third-party certified witness available on request. Certificate of destruction delivered to client within 30 business days of engagement close. Documented in MSA Wind-Down Schedule.All storage media
NIST 800-88GDPRHIPAA
Active
DDoS Mitigation — Always-On
Volumetric scrubbing active at network edge. Always-on — no client action required for activation. Managed SOC alerts on anomalous traffic patterns before client-visible impact. Optional: dedicated fiber/MPLS path to client HQ with contractually committed latency SLA per engagement.All client-facing network perimeter
SOC 2DORAISO 27001
Active
BGP Failover — Carrier-Diverse Dual Fibre
BGP failover <30 seconds. Carrier-diverse dual fibre from separate physical paths to the Pacific Northwest facility — no single-carrier dependency. DDoS scrubbing included. Optional: dedicated fiber/MPLS direct to client HQ with contractually committed latency SLA per engagement.Facility network connectivity
SOC 2DORAISO 27001
Active
AI Workload Traffic Isolation
AI inference traffic, model training I/O, and Verde NOC management traffic operate on physically separate Layer 3 network segments. Bandwidth contention between workload types architecturally prevented — not managed by QoS policy. Topology documented in MSA Technical Schedule.All AI compute traffic
SOC 2EU AI Act
Active
AI Artifact Storage Isolation
Model weights, training checkpoint files, and staged fine-tuning datasets stored on a physically isolated storage segment within the dedicated cage. Accessible only through the hardware-enforced TEE layer — not through general-purpose operational interfaces. Verde NOC cannot read or copy model weights even with full cage access.AI model artifacts — all clients
GDPREU AI ActHIPAA
Active
Flight Recorder Archive + Infrastructure State Reproducibility
Immutable, tamper-proof infrastructure event log: GPU health metrics, ECC error rates, thermal events, power anomalies, network events, and all access records retained for full engagement term. Verde cannot alter or delete records. Client-accessible and exportable for regulatory submission. Compatible with EU AI Act Article 12 logging requirements. Infrastructure State Reproducibility Archive: cryptographically signed configuration snapshot at each IE milestone and at every significant infrastructure change — allows IE-certified reconstruction of infrastructure state at any point for regulatory, legal, or insurance purposes. Post-Deployment Behavioral Baseline: issued by the Independent Engineer when the client AI model enters production — signed inference output record at a defined timestamp, structured for US Federal Reserve SR 11-7 model risk compliance.Full infrastructure stack — full engagement term
EU AI ActSOC 2DORA
Active
Hardware Health Telemetry — Real-Time
Continuous GPU cluster telemetry: ECC error rates, thermal metrics, power consumption, memory utilisation, and inference latency. Monitored 24/7 by dedicated NOC. Client security teams receive direct read-only dashboard access. Anomaly thresholds trigger automated NOC alerts before client-visible performance degradation occurs.Cluster hardware
SOC 2ISO 27001
Active
EU AI Act — Article 12 Audit-Ready Logging
Infrastructure logging architecture compatible with EU AI Act Article 12 (Regulation (EU) 2024/1689) automatic logging requirements for high-risk AI systems. Logs held in immutable tamper-proof storage separate from operational systems. Client-accessible and exportable in format submittable to EU regulatory authorities. Also addresses Article 13 transparency obligations to deployers.Clients deploying high-risk AI systems under EU AI Act
EU AI Act
Active
Shadow AI Perimeter Certificate
Documented certificate confirming network-layer controls preventing Verde-hosted AI models from receiving data ingestion from unsanctioned external sources: VLAN segmentation, ingress traffic classification, and allowlist-based ingress policy. Formatted for CISO AI governance programmes and cyber insurance underwriters. Updated quarterly.All clients
EU AI ActGDPR
Available
Independent Security Audit Right
Client may commission an independent infrastructure security audit at any time during the engagement term. Verde obligated to provide full access to relevant systems, telemetry, and documentation within 10 business days of written request. Verde cannot withhold or delay access. Panel composition, scope, and cost allocation defined in MSA at signing.Full engagement — client-initiated, any time
SOC 2ISO 27001DORA
Active
Surety Bond — Direct Client Recovery
Surety bond instrument sized per engagement value provides direct client financial recovery if Verde fails to deliver contractual obligations. Bond is binding at MSA signing — not issued retrospectively. Client recovery path is via the bond issuer directly, not solely via contractual penalty claims against Verde. Issued by institutional surety insurer named in MSA Insurance Schedule.Full engagementActive
· Insurance Consortium ·

Twenty-two policies.
One contract. Zero exposure.

An institutional insurance programme bound at Financial Close and pre-paid for the full duration of your engagement. You are covered before your cluster powers on.

22Policies
InstitutionalCyber Liability
Full TermBusiness Interruption
Engagement-SizedSurety Bond
AutoEmergency Cloud
COI + AI EndorsementDelivered on Execution
Additional Insured — Your Position

Not a contractual claim against Verde.
Direct rights under the policy itself.

On three key policies, you are named as Additional Insured — the same standing as the policyholder. If Verde is unresponsive, insolvent, or disputes the claim, you proceed directly to the insurer. Your recovery path does not depend on Verde's cooperation or solvency.

L4 · Cyber LiabilityAdditional Insured

Cyber Liability

Direct claim rights against the cyber insurer. Breach response, data recovery, and AI model reconstruction costs — accessible to you without Verde's involvement. Verde's insolvency or dispute does not block your claim.

L6 · CGLAdditional Insured

Commercial General Liability

Direct claim rights for third-party bodily injury or property damage arising from Verde's operations. Satisfies institutional procurement requirements without additional endorsement.

L5 · Technology E&OAdditional Insured

Technology Errors & Omissions

Direct claim rights for Verde professional errors, omissions, or service failures affecting your engagement. Covers your losses from Verde's professional liability — bypassing Verde's internal claims process entirely.

Certificate of Insurance (COI) with Additional Insured endorsement delivered at contract execution — not upon request. Your legal team may review the endorsement before signing.

Emergency Cloud Protocol

Six steps from failure to continuity.

At Verde's cost. Not yours. Insurance-backed and contractual.

<5 min

NOC Detection

Automated GPU health monitoring triggers alert. Verde NOC confirms P1 incident classification. (Response time defined in MSA Schedule B.)

<15 min

Activation

Pre-arranged emergency cloud capacity activated. No manual provisioning required. (Activation window defined in MSA Schedule B.)

Automatic

Migration

Workloads routed to emergency cloud infrastructure. No client action required.

<1 hour

Notification

Client notified with incident status, expected resolution timeline, and emergency cloud confirmation.

Next day

BI Claim

Verde's Business Interruption policy engaged. Extra Expense provision covers cloud burst costs.

On resolve

Restore

Primary cluster restored and validated. Emergency cloud deactivated. Post-Incident Review delivered within 5 business days.

Emergency Cloud activation costs are covered under L2 Business Interruption — Extra Expense provision. Verde bears the cost. No client approval or action required. Activation is automatic upon P1 incident classification.

All 22 policies.

Three categories: client-facing coverage, asset & facility protection, and operational continuity. Policies marked AI address AI governance liability introduced by EU AI Act (Regulation (EU) 2024/1689).

L1 · Property
Asset Protection

Hardware All-Risk

Full replacement value for all cluster hardware. Covers physical damage, theft, accidental damage from any cause.

L2 · BI
Client-Facing

Business Interruption

Revenue loss coverage for the full engagement term. Extra expense provision funds Emergency Cloud Compute activation at Verde's cost — not yours.

L2a · Extended BI
Client-Facing

Extended BI — Seismic & Force Majeure

Pacific Northwest seismic event extension to Business Interruption. Covers regional force majeure events explicitly excluded from standard BI: seismic events, regional power grid failure beyond 72h, and pandemic-level workforce disruption.

L2d · DSU
Asset Protection

Delay in Start-Up (DSU)

Pre-revenue coverage: activates if hardware delivery is delayed beyond the agreed delivery date. Covers Verde fixed costs during vendor delay — data centre fees, engineering staff, infrastructure licensing — so Verde remains solvent and client delivery is not jeopardised by a vendor schedule slip.

L3 · Trade Credit
Asset Protection

Trade Credit Insurance

Receivables coverage protecting against vendor and counterparty default risk. Ensures Verde can meet all engagement obligations without exposing client service continuity to supply-chain credit events.

L4 · Cyber
AIClient-Facing

Cyber Liability

Institutional-grade cyber liability coverage. Data recovery sub-limit — including AI model reconstruction costs. Breach notification costs. Client named as Additional Insured — direct rights under the policy.

L4b · Cyber-Physical
AIClient-Facing

Cyber-Physical Coverage

Dedicated coverage for physical hardware damage caused by cyber attacks. Closes the structural gap between standard cyber and property insurance — a gap that standard policies routinely exclude.

L5 · E&O
AIClient-Facing

Technology E&O

Professional liability for Verde's dedicated infrastructure service. Errors, omissions, and service failures. Client named as Additional Insured. Covers Verde's professional liability to you.

L6 · CGL
Client-Facing

Commercial General Liability

Third-party bodily injury and property damage. Client named as Additional Insured. Standard institutional procurement requirement — Verde's programme satisfies it.

L7 · Employer
Operational

Employer's Liability / Workers' Comp

Full coverage for Verde's engineering team. Statutory workers' compensation for all jurisdictions where Verde engineers operate.

L8 · PI
Client-Facing

Professional Indemnity

Design and specification errors. Covers Verde's professional liability for architecture, engineering, and operational decisions affecting client outcomes.

L9 · Cargo
Asset Protection

Cargo / Transit Insurance

Full hardware replacement value during transit from factory to data centre. Covers hardware loss, damage, or theft while in transit.

L10 · D&O
Operational

Directors & Officers

Verde leadership governance liability. Protects Verde management decisions — ensures Verde's operational continuity is not impaired by individual director exposure.

L11 · Crime
Asset Protection

Crime / Theft

Physical and cyber-enabled theft. In-cage IP camera evidence capture supports claims. Covers both internal and external theft events.

L12 · Pollution
Operational

Pollution Liability

Liquid coolant spill and environmental contamination coverage. Covers remediation costs for coolant-related environmental events in or around the data centre.

L13 · Umbrella
Asset Protection

Umbrella / Excess Liability

Excess layer over primary liability policies. Provides additional capacity where primary limits may be exhausted — institutional risk management standard.

L14 · Surety
Client-Facing

Surety / Completion Bond

Surety bond sized per engagement value. If Verde fails to deliver, the bond funds client recovery. This is not a contractual penalty — it is a financial guarantee.

L15 · Key Person
Operational

Key Person Insurance

Sized for multi-year replacement cost of critical personnel. Ensures engineering team continuity is financially secured — no service degradation from key engineer departure.

L2b · Contingent BI
Operational

Contingent Business Interruption

Covers Verde's revenue loss caused by physical failure at a key supplier: data centre closure, hardware vendor facility disaster, or logistics disruption. Triggers when Verde cannot operate due to a covered event at a named supplier — not Verde's own site.

L2c · Cyber CBI
AIOperational

Cyber Contingent BI / Systems Failure

Covers non-physical supplier disruptions: software license failures, cloud provider outages affecting Emergency Cloud burst capacity, and SaaS supply chain events. Standard Contingent BI requires physical damage — this endorsement covers software and system-level events.

L8b · EPLI
Operational

Employment Practices Liability

Covers Verde against employment-related claims from its engineering workforce: wrongful termination, workplace harassment, discrimination, and retaliation. Ensures Verde's operational budget is protected from employment litigation costs.

L16 · Equipment Breakdown
Operational

Equipment Breakdown Insurance

Covers electrical and mechanical breakdown of critical systems outside standard property coverage: CDU pumps, UPS modules, network switching fabric, and power distribution hardware. Bridges the gap between property damage and mechanical failure without external cause.

AI Governance Coverage — Active.L4, L4b, L5, and L2c are structured to address the AI operator liability categories introduced under EU AI Act Article 17: inference failure liability, training data contamination, model weight exfiltration, and AI output third-party claims. These policies are pre-structured — not amended at engagement initiation.

13 failure scenarios. Zero client cost.

ScenarioCovered BySeverityClient Outcome
Primary cluster hardware failureL1 Hardware All-Risk + Emergency Cloud (L2)Critical✓ Zero — automatic failover
Extended outage — full engagement termL2 Business InterruptionCritical✓ Zero — Verde absorbs
Seismic event — Pacific NorthwestL2a Extended BI — SeismicCritical✓ Zero — geographic extension
Cyber attack / ransomwareL4 Cyber LiabilityCritical✓ Zero — Verde's coverage
Cyber-physical hardware damageL4b Cyber-PhysicalCritical✓ Zero — dedicated coverage
Verde insolvencyL14 Surety BondCritical✓ Zero — client recovery guaranteed
Training data IP contamination during ingestionL4 Cyber + L5 Technology E&OCritical✓ Zero — Verde's coverage
Model weights exfiltrated during cluster migrationL4 Cyber + L4b Cyber-PhysicalCritical✓ Zero — AI-specific coverage
Client non-paymentL3 Trade CreditHigh✓ Zero — Verde's risk
Professional error by Verde teamL5 Technology E&OHigh✓ Zero — Verde liable
Hardware lost in transitL9 Cargo / TransitHigh✓ Zero — in-transit coverage
AI inference output — third-party liability claimL5 E&O + L6 CGLHigh✓ Zero — client Additional Insured
Key engineer departureL15 Key PersonMedium✓ Zero — replacement cost covered

All 22 policies are independently verified by a certificated commercial insurance broker. Certificate of Insurance (COI) with Additional Insured endorsement is delivered at contract execution — not upon request. Full policy schedule is available to client counsel and independent auditors under NDA at any time during the engagement term.

· Data Sovereignty ·

Your data,
architecturally unreachable.

All client data — training inputs, model weights, inference queries, and operational telemetry — is encrypted under client-controlled keys. Verde has zero plaintext access to any data layer, enforced by hardware architecture, not by policy commitment.

By architecture. Not by policy.
There is no override.

Architectural Guarantees

Your data never leaves your cage.

Dedicated cage · No cross-client network paths · Enforced at hardware layer

Your data never trains anything.

Contractual bar + architectural constraint · Applies to all Verde models

Verde cannot decrypt your storage.

BYOK key custody · Hardware-level constraint · Cannot be overridden

Verde Access Layer
Infrastructure TelemetryMonitored
Training Data ContentInaccessible
Model Weight FilesInaccessible
Inference Request ContentInaccessible
Encryption KeysNever Held
Storage ContentsCannot Decrypt
AES-256At-Rest Encryption
TLS 1.3In-Transit
BYOKClient Key Custody
72hIncident Notification
NIST 800-88Certified Erasure
ZeroVerde Plaintext Access
IP Ownership Guarantee

All model weights, training data, workload outputs, and intellectual property remain exclusively owned by the client. Confirmed in writing in the MSA. No exceptions.

HIPAA BAAFor Healthcare Clients

Verde operates as your Business Associate under HIPAA. Verde never accesses, views, or processes Protected Health Information (PHI) directly. Infrastructure-level technical safeguards — encryption, access controls, audit logging — are specified in the MSA and implemented per the deployment schedule. HIPAA Business Associate Agreement (BAA) executed before go-live.

SLA MatrixPhysical Response & Incident Notification · Contractually Committed in Verde MSA
Physical Response Tier
Verde L3+ Engineers24/7On-site 24/7 from go-live (MSA committed) · zero travel time
DC Smart Hands P115 minOn-site physical response · MSA committed
DC L3 + 4-Eyes SLA1 hrL3 engineering + dual-authorisation cage access
Vendor Parts SLA4 hrsDedicated parts · on-site spare inventory
Incident Notification
P1 — Critical2 hrsClient notification · cluster or critical service impact
P2 — High4 hrsClient notification · degraded performance events
Regulatory Breach72 hrsCCPA, NY SHIELD, GDPR-aligned reporting
Media Sanitization30 daysNIST SP 800-88 certificate on decommission
100% Logged & Auditable · 4-Eyes Policy on all cage access · 90-day CCTV retention·Post-Incident Review (PIR) within 5 business days of P1/P2 resolution·Semi-annual tabletop exercises included in all engagements

No Cross-Client Data

Dedicated SPV per engagement. Legally ring-fenced. No client data ever shares a legal entity, physical space, or network path with another Verde client.

NIST SP 800-88 Erasure

Cryptographic and physical media sanitization per NIST SP 800-88 at engagement end. Certificate of destruction delivered within 30 business days.

72-Hour Incident Notification

GDPR and CCPA-aligned incident notification. P1 incidents: Operations Desk first response within 15 minutes; written client notification within 2 hours. P2: within 4 hours. Full 72-hour reporting obligation met for all qualifying incidents.

No Retention Post-Engagement

All client data deleted upon engagement conclusion. No backup retention. Deletion certified and documented. No data used for any Verde purpose at any time.

Background Screening & Engineer Qualification

All Verde personnel with cage or system access undergo background screening prior to onboarding. Annual re-screening for all engineers on dedicated engagements. Verde commits in the MSA to a minimum of 15 individually L3+ GPU Infrastructure Certified engineers per engagement — names, certification levels, and role assignments are delivered 30 days before go-live and documented in MSA Exhibit A.

Monthly Vulnerability Scans

Monthly vulnerability scans across full stack. Critical CVE remediation within 48 hours. High CVE within 7 days. Results available to client security team under NDA.

Annual Penetration Test

External and internal penetration test annually. Third-party independent testing firm. Full report and remediation log available to client under NDA.

PAM Access Logging

Every Verde engineer OS-layer access logged with timestamp, identity, and duration. Time-limited credentials. No standing access. Log stream available to your security team in real time.

Training Data Provenance Seal

California AB 2013 (Generative AI Training Data Transparency Act), in force since January 1, 2026, requires enterprises developing or substantially modifying generative AI systems for public use to publicly disclose training data sources, types, volume, IP status, and any use of personal information. For organisations using Verde's infrastructure to train or fine-tune AI models, Verde provides a Training Data Provenance Seal: a timestamped, cryptographically signed record of the data ingestion events — when data entered the cluster, from what verified source, and under what access controls — available at any point for compliance documentation. Verde does not inspect, read, or classify the content of client training data. The seal documents the infrastructure-layer chain of custody: source, transit encryption, ingress timestamp, and storage location. This is an infrastructure audit trail — not a content audit.

Model Access Escrow — Independent Trustee at Go-Live

A client-controlled copy of all AI workload access credentials, API configurations, network architecture documentation, and BYOK key recovery procedures is deposited with the independent trustee at go-live. Client access to their own infrastructure and data does not depend on Verde cooperation under any circumstance — including Verde insolvency. This is Ring-Fence 09 (RF-09) of Verde's 15 bankruptcy-remote structural protections: the escrow deposit is made before the SLA clock starts and Verde cannot revoke or modify it.

AI Compute Forensics

Following a P1 incident, system failure, or unexpected AI output event, forensic investigation of the infrastructure layer requires preserved, unaltered evidence of the cluster state at the relevant time. Verde's AI Compute Forensics capability preserves: GPU operational telemetry at the incident time (ECC error rates, thermal state, clock speeds, memory utilisation), inference queue depth and request volume at the incident moment, network traffic classification (without content inspection), and NOC access logs. Evidence is extracted and delivered in a forensic-standard format — timestamped, hashed, and chain-of-custody documented — within 72 hours of client request. This evidence is relevant for insurance claims investigation, regulatory incident reporting, and litigation support. It covers the infrastructure layer only: model architecture, training data, and inference content are never accessible to Verde under any circumstance.

AI Compute Forensics

Your auditors ask.
Verde answers — before the question.

Every GPU cycle, every job, every access event — cryptographically logged, tamper-evident, and available on audit request. From hardware attestation to regulatory retention, Verde's forensic infrastructure meets 2026 compliance requirements by design.

GPU Monitoring · Continuous

GPU Telemetry Ledger

Every GPU's health state — recorded and signed.

Continuous per-GPU telemetry stream: single-bit and double-bit memory error counts, hardware fault codes, thermal state (°C), interconnect bandwidth, and power draw. Each record is timestamped and stored in Verde's SIEM with cryptographic integrity verification — no metric can be altered retroactively. Industry efficiency target: 65–75% average GPU utilisation (2026 enterprise benchmark). Verde reports this metric monthly, giving clients forensic-grade evidence of resource performance against the dedicated cluster they contracted.

  • Memory error counts (single-bit / double-bit) — per GPU, per hour
  • Hardware fault codes — classified per GPU manufacturer taxonomy
  • Thermal + power telemetry — full operational history
  • Utilisation rate — vs. 65–75% industry efficiency target
EU AI Act Art.12 · Per-job

Workload Audit Log

Every job. Every GPU. Every second. Legally recorded.

Complete lifecycle log for every compute job: submission timestamp (UTC, millisecond precision), assigned GPU identifiers, client namespace, queue priority, preemption events, model version reference, human oversight checkpoints, and completion status. This record satisfies EU AI Act Article 12 automatic logging requirements for high-risk AI systems (Annex III — financial services, healthcare, critical infrastructure) and serves as the primary SOC 2 Processing Integrity (PI) attestation. Monthly GPU-hour consumption exports delivered to client. Compliance deadline: 2 December 2027.

  • Start / end timestamps — UTC, millisecond precision
  • GPU identifier assignment — hardware-level traceability
  • Client namespace isolation — zero cross-tenant visibility
  • Human oversight checkpoints — EU AI Act Art.12 requirement
  • Monthly GPU-hour export — client-auditable
TRACE · Composite CPU+GPU

Hardware Attestation

Cryptographic proof your workload ran on exactly these GPUs.

Every GPU and host processor in Verde's cluster carries a hardware attestation certificate binding device identity to its firmware state and Trusted Execution Environment (TEE) configuration. Verde implements composite attestation — CPU and GPU jointly verified per the Linux Foundation TRACE specification (August 2026) — the open standard for AI agent and confidential workload attestation. Fail-closed policy: if attestation evidence is stale, firmware has drifted, or debug mode is detected, the workload is rejected before execution begins. On audit request, Verde produces a composite attestation report: which physical processors handled your workload, firmware at time of execution, and the full certificate chain.

  • Composite attestation — CPU + GPU jointly verified (TRACE spec)
  • TEE configuration state — hardware-rooted, cryptographically signed
  • Firmware version at time of workload execution
  • Facility proof — hardware residence in identified, trusted facility
  • Provenance report — available per regulatory audit request
Tiered Retention · Tamper-Evident

SIEM Audit Trail

Every access. Every action. For as long as the law requires.

Verde's centralised SIEM aggregates all infrastructure access events: NOC operator sessions, physical cage access (biometric log), network anomalies, change management records, guardrail state changes, and hardware state transitions. Logs are stored with cryptographic hash-chain integrity — no log can be deleted or altered without a detectable break in the chain. Retention follows a purpose-based schedule aligned with GDPR Article 5(1)(e) storage limitation: no data is held beyond its regulatory purpose. This is not a liability — it is the 2026 compliance standard. Regulators in 2026 penalise excessive retention without documented legal basis as heavily as insufficient retention.

  • NOC access log — role, timestamp, action scope, session ID
  • Physical cage access — biometric, visitor records, 4-Eyes confirmation
  • Change management — every firmware / config change, CAB approval
  • Guardrail & model drift monitoring — state change history
  • Alert history — P1/P2 incident timeline reconstruction
Log Retention Schedule

Purpose-based retention — minimum necessary, by regulation.

90 daysOperationalSOC 2 CC7.2
6 monthsEU / High-Risk AIEU AI Act Art.12
12 monthsHealthcareHIPAA §164.312
7 yearsFinancialSOX 404 / SEC

GDPR Article 5(1)(e) storage limitation applies. Holding logs beyond their regulatory purpose without documented legal basis is a compliance liability — not additional protection. Verde applies the minimum necessary retention, matched to each client's regulated sector.

Compliance Posture

Committed in the MSA.
Roadmap scheduled.

Twelve compliance controls are committed in the MSA and delivered or started from contract execution. ISO 42001 AI Management System control mapping is delivered under the MSA. SOC 2 and ISO 27001 timelines are committed in the MSA Compliance Schedule.

16Committed ControlsPer MSA · contractually committed
1Mapped Under MSAISO 42001 control mapping · delivered under the MSA
5Roadmap ItemsSOC 2 Type I/II · ISO 27001 · SSAE 18
Standard / FrameworkStatusDescription
Committed in MSA16 controls
OFACAt SigningSanctions screening of Verde personnel and transactions begins at contract execution.
EAR / Supply Chain CompliancePer MSAHardware procurement committed exclusively through manufacturer-authorised, EAR-compliant channels. Documented chain of custody from factory to Pacific Northwest facility. All personnel and transactions subject to OFAC sanctions screening.
NIST SP 800-88Per MSAMedia sanitization at engagement end. 30 business day certificate of destruction.
CPRA/CCPA (2026) / GDPR / NY SHIELDPer MSACPRA/CCPA requirements effective 1 January 2026 are addressed under the MSA: mandatory DPIA for high-risk AI processing, Automated Decision-Making Technology transparency notices, Universal Opt-Out (GPC) signal compliance. GDPR Article 83 enforcement is ongoing — cumulative fines exceeding €7.1 billion by mid-2026; dual-regulatory exposure with EU AI Act managed under Verde's integrated framework. 72-hour incident notification commitment meets GDPR Art. 33, CCPA, NY SHIELD, and SEC Reg S-P vendor notification requirements.
NIST CSF 2.0Architecture-AlignedBoard-level cybersecurity governance framework aligned to NIST Cybersecurity Framework 2.0.
HIPAA BAAPer MSAVerde acts as Business Associate for healthcare clients under a BAA executed before go-live. Infrastructure-level technical safeguards are designed in. Verde never accesses, views, or processes PHI directly.
Clean-Agent Fire SuppressionPer MSAClean-agent suppression system committed for all compute areas. Annual licensed engineer inspection certificate provided.
SOC 2 (Facility Level)Facility OperatorData centre operator holds SOC 2 Type II certification. Operator audit reports available to Verde clients under NDA on request.
WREGIS / Scope 2 Carbon — CSRD / ISSBPer MSAQuarterly Scope 2 carbon report delivered to client — WREGIS Renewable Energy Certificate certified. Audit-ready for CSRD, ISSB S1/S2, California SB 253, and equivalent regulatory frameworks. Includes facility PUE disclosure and REC verification. Verde operates on 100% hydroelectric baseload — not offset credits.
EU AI ActArchitecture-AlignedHigh-Risk AI Systems — Article 12 (Logging capability) and Article 13 (Transparency to deployers). Regulation (EU) 2024/1689, in force August 1, 2024. Article 12 requires automatic event logging for high-risk AI systems throughout their lifecycle — Verde infrastructure stores SIEM, PAM, and inference telemetry records in immutable, tamper-proof storage; Verde cannot alter or delete records; all logs are client-accessible and exportable for regulatory submission. Article 13 requires transparency and documentation to deployers — addressed by Sovereignty Control Matrix, monthly infrastructure report, and IE certifications. Architecture-ready posture applies to clients operating in Annex III high-risk AI categories (enforcement: August 2, 2026 — August 2, 2027 depending on category).
AI Infrastructure Audit Opinion — Independent EngineerPer MSAVerde's Independent Engineer issues formal audit opinions on infrastructure performance and compliance at defined milestones: Go-Live Certification (cluster readiness vs. MSA Hardware Schedule), Annual Re-certification (hardware and software stack against engagement specifications), and Post-Incident Review (infrastructure state at time of any P1/P2 event). These are independent third-party opinions — not Verde self-certification. Clients receive the original IE opinion letters for submission to their own auditors, regulators, or insurers.
Sovereignty Control Matrix — 5-Layer Client Control DocumentationPer MSAVerde provides a documented Sovereignty Control Matrix at engagement initiation: a structured mapping of the five control layers and their owners. Layer 1 (Model Weights): 100% client — hardware TEE + BYOK, Verde architecturally excluded. Layer 2 (Training Data): 100% client — Verde holds no decryption key, no ingestion inspection. Layer 3 (Inference Outputs): 100% client — outputs are never logged, inspected, or retained by Verde. Layer 4 (Infrastructure Configuration): Verde operational control with client audit rights and IE oversight. Layer 5 (Physical Facility): Facility operator control with Tier III certification, Verde colocation access documented. The Matrix is a client-deliverable compliance document — relevant for enterprise AI governance, insurance underwriting, and regulatory disclosure.
NIST AI RMF 1.0Architecture-AlignedVerde infrastructure governance aligned to NIST AI RMF 1.0 core functions: Govern, Map, Measure, Manage. NIST AI RMF Profile on Trustworthy AI in Critical Infrastructure (concept note published April 2026) framework observed. Relevant for financial services, enterprise AI, and critical infrastructure clients.
SEC Regulation S-P (2024 Amendments)Regulation in Effect — Dec 2025 / Jun 2026In full effect: larger covered institutions (December 3, 2025); smaller entities (June 3, 2026). Requires a written Incident Response Program, customer breach notification no later than 30 days after awareness of a qualifying incident, and written service provider oversight policies. Verde's documented IR programme and immutable audit trail architecture meet the IRP and recordkeeping requirements. Applicable for broker-dealers, registered investment advisers, investment companies, and transfer agents using Verde infrastructure.
NERC CIP (CIP-002-8 / CIP-003-11)Architecture AlignedVerde infrastructure designed to align with NERC CIP isolation, physical security, and electronic access control requirements — including 2026 updates to CIP-002-8 (revised control center definitions) and CIP-003-11 (expanded electronic access controls). Relevant for energy sector, grid operators, ISOs, and RTOs deploying AI.
TISAX ISA2027 / ISO/SAE 21434 / UNECE WP.29Architecture CompatibleTISAX ISA2027 (mandatory January 2027) maps exclusively to ISO/IEC 27001:2022 and IEC 62443 — removing all ISO/IEC 27001:2013 references. Verde infrastructure access controls, network segmentation, and event logging support TISAX Level 2/3 CSMS requirements. UNECE WP.29 first global driverless ADS regulatory framework adopted June 2026. Applicable for Tier 1/2 automotive suppliers and OEMs.
Mapping Per MSA1 item
ISO 42001 — AI Management SystemMapping Per MSAAnnex A gap analysis and control mapping are delivered to your audit team under the MSA. Not a certification.
Roadmap5 items · MSA committed
Parent Holding Master SOC 2 Type IIStarts at SigningThe Master SOC 2 Type II programme begins at contract execution and covers 24/7 NOC/SOC, PAM, SIEM, DevSecOps, and employee background checks across all five Trust Service Criteria. Scope and timeline are defined in the MSA Compliance Schedule.
Client SPV Scope Extension & Bridge LetterPer MSAEach client dedicated Delaware SPV is scheduled to receive a SOC 2 Scope Extension Bridge Letter from our CPA firm (T+30 Days from contract execution), extending Holding Master SOC 2 controls to the dedicated cage and BYOK enclave.
ISO 27001RoadmapControl mapping delivered under the MSA. Certification scope and timeline defined in the MSA Compliance Schedule. Facility operator holds independent ISO 27001 certification.
SSAE 18RoadmapFinancial controls and attestation framework (successor to SAS 70). SSAE 18 is the standard under which SOC 1 reports are issued — covering internal controls over financial reporting. Relevant for institutional counterparties and regulated-sector clients requiring formal attestation of Verde financial control architecture. Aligned with Parent Holding Master SOC 2 Type II architecture.
HIPAA Type IIRoadmapFull HIPAA audit cycle aligned with Parent Holding Master SOC 2 Type II architecture.
ISO 42001 — Delivered Under the MSA

Verde's ISO 42001 AI Management System control mapping is a contractual deliverable under the MSA — not a certification. An Annex A gap analysis and AI governance documentation package are delivered to your audit team under the MSA. For enterprises requiring AI governance documentation for procurement, board reporting, or regulatory review.

Dual-Tier SOC 2 Governance

Parent Holding Master SOC 2.
Extended to your SPV.

Verde Compute, Inc. (Holding) commits to a Master SOC 2 Type II audit programme that begins at contract execution, extended to each client Delaware SPV via a CPA Scope Bridge Letter relative to contract execution ($T_0$ to $T+365$ Days). All five AICPA Trust Service Criteria covered.

T₀ (Setup)SPV & Master PackageSPV incorporation · Escrow waterfall · SOC 2 audit engagement initiated
T + 30 DaysSPV Bridge LetterSPV cage isolation · BYOK boundary · CPA Scope Extension
T + 365 DaysAnnual Re-AttestationHolding annual audit renewal · Continuous SPV compliance re-certification
T₀ (Setup)

Contract execution starts the programme: SPV LLC incorporated, escrow waterfall activated, and the SOC 2 Type II scope and audit engagement initiated per the MSA Compliance Schedule.

T + 30 Days

Dedicated cage isolation, BYOK encryption boundary, and CPA SPV Scope Extension Bridge Letter issued, extending Master SOC 2 to client SPV.

T + 180 Days

SPV live production workloads operate under continuous Holding NOC/SIEM monitoring and 6-month observation period verification.

T + 365 Days

Parent Holding annual Master SOC 2 Type II audit renewal completed; SPV continuous compliance re-certification delivered at contract anniversary.

Five Trust Service Criteria.

All five AICPA Trust Service Criteria covered in Verde's SOC 2 programme.

CCSecurity

Access controls · MFA enforcement · AES-256 encryption · network security · incident response · PAM-logged access

AAvailability

Dual-dimension SLA: (1) availability — multi-layer architecture: Tier III DC design availability (99.982% design standard) + Emergency Cloud Compute automatic failover at Verde's cost + 21-policy insurance consortium. Client-facing SLA percentage defined per engagement in MSA SLA Schedule; (2) performance — p99 inference latency under defined production load, independently certified at Go-Live before SLA clock starts. Emergency Cloud Compute auto-activates upon any primary cluster unavailability — at Verde's cost, not yours.

PIProcessing Integrity

GPU workload completion logging · error detection and alerting · scheduled maintenance windows · hardware acceptance test at 97% factory benchmark threshold — independently certified by third-party engineer before SLA clock starts (industry norm: self-certification or no defined threshold)

CConfidentiality

Client workload isolation · TLS 1.3 in transit · AES-256-GCM at rest · BYOK · Hardware-Native TEE available

PPrivacy

CCPA/GDPR readiness · data minimization policy · post-engagement deletion with certificate · HIPAA BAA for healthcare

Verde Compute · Protection Architecture

Security review
available
on request.

Our team walks through each protection layer with your security, legal, and procurement teams before contract execution. Compliance documentation, insurance certificates, and architecture detail are available under NDA at any stage of your evaluation. No commitment required.

Begin EngagementSPV Structure & Compliance Stack