Access controls · MFA enforcement · AES-256 encryption · network security · incident response · PAM-logged access
Trust Center · For CISO · Legal · ProcurementTrust Center
Trust Center
built for your team.
Physical security, data handling commitments, compliance posture, and audit access — documented for enterprise procurement review.
One cluster. One team. One contract. Zero shared tenancy — protected by architecture, not by policy. Independent audit at every layer.
Zero Trust
Architecture — Identity-Verified Access at Every Layer
BYOK
Customer Key Sovereignty — Zero Verde Access to Decrypted Data
21-Policy
Insurance Consortium — Client Named as Additional Insured
72h
Maximum Incident Notification — GDPR Art. 33 · CCPA · SEC Reg S-P · NY SHIELD
Protection Architecture12 independent layers.
12 independent layers.
Every one named.
Legal isolation, financial transparency, technical sovereignty, regulatory compliance, and continuous independent audit — layered to eliminate single points of failure across every engagement.
Legal & Financial
L1
Delaware SPV
Legal ring-fence per engagement. No cross-contamination between engagements or with Verde corporate estate.
L2
5-Account Escrow Waterfall
Independent institutional trustee. 7-tier priority disbursement. Client funds never commingled with Verde corporate cash.
L3
Surety Bond & IE Certification
Direct financial performance guarantee. Independent Engineer certifies all cluster milestones prior to financial release.
L4
21-Policy Insurance Consortium
Institutional-class carriers. Client named as Additional Insured on Cyber Liability, Technology E&O, and CGL. Pre-paid for the full engagement term at Financial Close.
Technical & Infrastructure
L5
BYOK Encryption
AES-256-GCM at rest · TLS 1.3 in transit · Zero Verde decryption capability · Client holds all keys.
L6
Tier III Certified Facility
99.982% DC design availability · SOC 2 Type II · ISO 27001 · Clean-agent fire suppression · Seismic-rated.
L7
Physical Access Control
Biometric 3-factor · 4-Eyes policy · 90-day CCTV retention · Verde L3+ 24/7 on-site from go-live (MSA committed) · DC Smart Hands 15-min P1 · DC 1-hr L3 + 4-Eyes SLA · Vendor 4-hr parts SLA.
L8
NIST SP 800-88 Data Erasure
Zero retention post-engagement. Certificate of destruction issued within 30 business days.
Compliance & Audit
L9
OFAC / EAR / GDPR / CCPA / DORA
Regulatory compliance framework. OFAC screening at every engagement. GDPR Art.33, CCPA, and NY SHIELD 72-hour incident notification committed in the MSA. DORA (in force January 17, 2025) ICT concentration risk and exit-plan documentation built into MSA at signing for EU financial-sector clients. Starts from engagement initiation.
L10
Daily MSOC Monitoring
Managed SOC platform. Operational from go-live. SLA chronometer. NOC telemetry.
L11
Monthly Financial Review
Independent CFO · Corporate Trust Officer · FinOps report in CFO-ready format.
L12
Annual Institutional Audit
Balance sheet · Solvency opinion · Independent cyber audit · Full transparency report. Effective from first operational year.
Network-Isolated Dedicated Cage
Every client deployment occupies a physically isolated, locked cage with dedicated network segmentation. Zero physical or network sharing with any other client under any circumstance.
Biometric 3-Factor Access Control
All physical access to client cage requires three-factor biometric authentication. Access logs are immutable and available for client audit at any time during the engagement.
24/7 CCTV Surveillance
Continuous surveillance across all facility areas. 90-day footage retention. Footage available for client audit on request.
On-Site Coverage Stack — Verde L3+ 24/7 (MSA) + DC Smart Hands 15-min
Under the MSA, Verde commits its own L3+ certified engineers to 24/7 on-site coverage at the DC from go-live — zero travel time; roster delivered 30 days before go-live. DC facility Smart Hands: P1 on-site response within 15 minutes of confirmation, MSA committed. DC operator: 1-hour L3 engineering + 4-Eyes dual-authorisation SLA. Hardware vendor: 4-hour dedicated parts SLA with on-site spare inventory. All access authenticated, logged, and auditable.
Seismic-Rated Installation
Pacific Northwest code compliance. Seismic zone certificate provided at engagement signing. Extended Business Interruption coverage addresses seismic events beyond standard policy exclusions.
Your data never leaves your cage.
Your data never trains anything.
Verde cannot decrypt your storage contents under any circumstance — by architectural constraint, not policy.
No Cross-Client Data Access — Ever
Hardware-level and network-level isolation ensures no path exists between client environments. Dedicated SPV per engagement. Architectural design commitment, not merely policy-based.
NIST SP 800-88 Data Erasure at Conclusion
All client data securely erased per NIST SP 800-88 within 30 business days of engagement conclusion. Certificate of destruction issued to the client within this window.
72-Hour Incident Notification
P1 incidents: Verde 24/7 Operations Desk first response within 15 minutes; written client notification within 2 hours. P2: within 4 hours. Full 72-hour reporting obligation met for all qualifying incidents — aligned with GDPR Art. 33, CCPA, and NY SHIELD Act.
No Data Retention After Engagement
Verde retains no client data, model weights, or workload artifacts following engagement conclusion. No backup exceptions.
Background Screening — All Engineers
Every engineer assigned per engagement completes background screening prior to deployment access being granted. Annual re-screening for all engineers on active engagements.
Annual Third-Party Penetration Test
Independent penetration testing of all infrastructure and network controls annually. Results shared with authorized client counterparties upon request under NDA.
Formal Incident Response Plan
A documented IR plan is provided to clients at engagement start. Covers detection, containment, notification, and recovery procedures — tested prior to first operational day.
PAM Engineer Access Logging
All Verde engineer OS-layer access is logged with timestamp, identity, and duration. Time-limited credentials. No standing access. Log stream available to the client security team in real time via the Verde Governance Portal.
Model Access Escrow — Independent Trustee at Go-Live
A client-controlled copy of all AI workload access credentials, API configurations, network architecture documentation, and BYOK key recovery procedures is deposited with the independent trustee at go-live. Client access to their own infrastructure and data does not depend on Verde cooperation under any circumstance — including Verde insolvency. Aligned to RF-09 of the 15 bankruptcy-remote ring-fence architecture.
AI Compute Forensics — Infrastructure-Layer Evidence
Following any P1 incident, unexpected AI output event, or regulatory investigation, Verde delivers forensic-standard infrastructure-layer evidence within 72 hours of written client request. Preserved data: GPU operational telemetry at the incident time (ECC error rates, thermal state, clock speeds, memory utilisation), inference queue depth and request volume, network traffic classification (without content inspection), and NOC access logs with identity and timestamp. Evidence is cryptographically hashed and chain-of-custody documented from capture to delivery — structured for insurance claims substantiation (BI and Cyber Liability policies), HIPAA Breach Notification, SEC SAR reporting, EU GDPR Article 33, and legal discovery. Scope boundary: model architecture, training data, and inference content are never accessible to Verde — BYOK encryption and Hardware-Native TEE enforce this architecturally, not by policy.
Institutional Governance
Financial Architecture
Structural safeguards protecting clients, counterparties, and insurers — built into every engagement by design, not by negotiation.
5-Account Escrow Waterfall — Independent Trustee
All client revenue flows through a 5-account escrow structure managed by an independent institutional trustee designated at Financial Close. 7-tier priority waterfall: Senior obligations → Operating costs → Debt Service Reserve replenishment → Pre-funded Reserve contribution → Operational Reserve contribution → Contingency Reserve Account → Verde distributions. Client funds never commingled with Verde corporate cash. Verde cannot distribute equity until all six prior tiers are satisfied — including the Contingency Reserve, which buffers unforeseen operational costs without recourse to client funds. Full waterfall mechanics defined in the Escrow Agreement — available for legal review.
Escrow agent identity and full waterfall mechanics disclosed to qualified clients under NDA.
BYOK Hardware Encryption — Customer Keys Only
Customers hold sole possession of their encryption keys. Verde engineers have zero access to decrypted workload data, model weights, or training artifacts at any time. AES-256-GCM at rest + TLS 1.3 in transit as standard. Keys provisioned by client prior to first operational day and never stored, copied, or accessible by Verde personnel or infrastructure systems.
Tier III Certified Facility · ISO 27001 · Seismic-Rated
Pacific Northwest Tier III certified data centers with SOC 2 Type II and ISO 27001 certification. Clean-agent fire suppression (wet-pipe expressly prohibited in compute areas). Seismic-rated installation per Pacific Northwest building code. DC design availability: 99.982% (Tier III certified standard). Verde infrastructure SLA: multi-layer architecture — Tier III DC design availability + Emergency Cloud Compute automatic failover at Verde's cost + 21-policy insurance consortium. Client-facing SLA percentage defined per engagement in the MSA SLA Schedule. 100% renewable energy · REC-certified hydroelectric baseload.
Facility operator identity and full SLA terms disclosed to qualified clients under NDA.
Engagement Surety Bond — Direct Client Financial Remedy
An engagement-sized surety bond is issued at Financial Close providing the client with a direct financial remedy independent of Verde corporate assets if Verde fails to deliver per the MSA. The surety bond does not require the client to pursue litigation to enforce — it is a separate, direct financial assurance mechanism independent of the 21-policy insurance consortium. No best-efforts escape clause, no commercially reasonable efforts language. Performance is bonded.
21-Policy Insurance Consortium — Client as Additional Insured
All 21 insurance policies pre-paid for the full engagement term at Financial Close. Coverage includes: Hardware All-Risk (full replacement value) · Business Interruption covering the full duration of your engagement term · Cyber Liability with AI model data-recovery sub-limit · Technology E&O · Trade Credit · Surety Completion Bond · 14 further specialized policies and endorsements. Client named as Additional Insured on Cyber Liability, Technology E&O, and Commercial General Liability — direct insurance rights, not merely a contractual claim against Verde.
Full policy schedule and certificates of insurance provided to qualified clients under NDA.
Sovereignty Control Matrix — 5-Layer Client Control Documentation
Verde provides a structured Sovereignty Control Matrix at engagement initiation: a compliance-ready document mapping control ownership across five layers. Layer 1 (Model Weights): 100% client — hardware TEE + BYOK, Verde architecturally excluded. Layer 2 (Training Data): 100% client — Verde holds no decryption key. Layer 3 (Inference Outputs): 100% client — never logged, inspected, or retained by Verde. Layer 4 (Infrastructure Configuration): Verde operational control with client audit rights and IE oversight. Layer 5 (Physical Facility): Facility operator, Tier III certified, Verde colocation access documented. Relevant for enterprise AI governance board reporting, insurance underwriting, and regulatory disclosure to EU AI Act, SEC, and HIPAA/HITECH auditors.
15 Bankruptcy-Remote Ring-Fences — Structural Protection
Verde's SPV architecture incorporates fifteen structural ring-fences that protect the engagement from Verde corporate insolvency. These are legal and financial protections built into the structure — not contractual clauses that depend on Verde's cooperation or solvency. Key ring-fences: (RF-01) Separate legal entity — SPV liabilities do not reach Verde corporate or the client. (RF-03) Dedicated escrow — client funds in segregated 5-account escrow, never commingled with Verde corporate cash. (RF-05) Hardware title in SPV — cluster hardware titled in the SPV, not Verde Inc. (RF-06) No cross-default — default in another Verde SPV does not trigger default in yours. (RF-07) Client IP outside SPV — your models, training data, and outputs cannot be reached by any Verde creditor. (RF-08) Surety bond — direct client financial remedy if Verde fails to deliver. (RF-09) Model Access Escrow — access credentials deposited with independent trustee at go-live. (RF-10) Change-of-Control Protection — if Verde Inc.'s ownership changes to a non-approved counterparty, the client retains the right to exit without remaining financial obligation; defined at MSA signing, not negotiated at event. Full 15-ring-fence architecture documented in the Standards Legal Architecture section.
Full SPV structure and ring-fence documentation disclosed to qualified clients under NDA.
MSOC Monitoring
Managed SOC platform active from first operational day per engagement agreement. Real-time SLA chronometer and telemetry logs available to clients via the Verde Governance Portal. NOC telemetry includes GPU health, inference queue depth, and network anomaly detection.
Financial Review
Independent CFO engagement and dedicated Corporate Trust Officer. Monthly FinOps report delivered to all designated stakeholders — GPU cluster utilisation by cost centre in CFO-ready format. Tokens-per-Watt quarterly efficiency metric — AI inference tokens generated per watt consumed — delivered alongside the Quarterly Business Review; relevant for internal AI infrastructure governance, SEC Scope 3 AI energy reporting, and CSRD/ISSB S1/S2 sustainability disclosure. Escrow waterfall compliance sign-off confirming no disbursements outside the 7-tier sequence.
Institutional Audit
Annual balance sheet audit by an internationally recognized top-tier firm. Independent hardware asset valuation. Solvency opinion and capital adequacy certificate. Full annual transparency report. Effective from first operational year.
Post-Deployment Behavioral Baseline
Issued by the Independent Engineer when your AI model enters production — a cryptographically signed inference output record at a defined timestamp. Establishes an independently certified reference point for model behaviour. Structured to support US Federal Reserve SR 11-7 model risk documentation, EU AI Act Article 9 risk management system requirements, M&A due diligence, and insurance underwriting. Model architecture, training data, and inference content are never accessible to Verde — the baseline is an infrastructure-layer certificate only.
Full Standards Detail
Complete audit methodology, vendor accountability framework, and engineering standards are documented on the Standards page.
View Standards →Dual-Tier SOC 2 Governance
Parent Holding Master SOC 2. Extended to your SPV.
Verde Compute, Inc. (Holding) commits to a Master SOC 2 Type II audit programme that begins at contract execution, extended to each client Delaware SPV via a CPA Scope Bridge Letter relative to contract execution ($T_0$ to $T+365$ Days). All five AICPA Trust Service Criteria covered.
T₀ SPV Setup & OnboardingT+365 Days Annual Re-Attestation
SPV Setup & Master Package
Contract execution starts the programme: SPV LLC incorporated, escrow waterfall activated, and the SOC 2 Type II scope and audit engagement initiated per the MSA Compliance Schedule.
- SPV Delaware LLC incorporation & legal ring-fencing
- Escrow 5-account & 7-tier waterfall activation
- Master SOC 2 Type II audit engagement initiated per MSA Compliance Schedule
- Colocation facility CSOC SOC 2 report shared under NDA
SPV Scope Bridge Letter
Dedicated cage isolation, BYOK encryption boundary, and CPA SPV Scope Extension Bridge Letter issued, extending Master SOC 2 to client SPV.
- Dedicated SPV cage isolation & network VLAN setup
- BYOK encryption boundary configuration
- CPA firm SPV Scope Extension Bridge Letter issuance
- Audit bridge package delivered to client CISO
Production Observation
SPV live production workloads operate under continuous Holding NOC/SIEM monitoring and 6-month observation period verification.
- Live production workloads operating on dedicated cluster
- Continuous 24/7 Holding NOC/SIEM telemetry monitoring
- 6-month observation period audit evidence verification
- No cross-client or co-tenancy access permitted
Annual Re-Attestation
Parent Holding annual Master SOC 2 Type II audit renewal completed; SPV continuous compliance re-certification delivered at contract anniversary.
- Parent Holding annual Master SOC 2 Type II renewal
- SPV continuous compliance re-certification delivered
- All five AICPA Trust Service Criteria re-evidenced
- Annual bridge package committed in MSA Schedule
Dual-Tier Compliance Schedule committed in MSA
Parent Holding Master SOC 2 Type II audit and SPV Scope Bridge Letters are contractual obligations — not aspirational targets. Your dedicated SPV is scheduled to receive a Scope Bridge Letter at T+30 Days and annual re-attestation at T+365 Days from contract execution. Facility operator holds SOC 2 Type II certification — operator audit reports available under NDA on request.
Five Trust Service Criteria.
All five AICPA Trust Service Criteria covered in Verde's SOC 2 programme.
Dual-dimension SLA: (1) availability — multi-layer architecture: Tier III DC design availability (99.982% design standard) + Emergency Cloud Compute automatic failover at Verde's cost + 21-policy insurance consortium. Client-facing SLA percentage defined per engagement in MSA SLA Schedule; (2) performance — p99 inference latency under defined production load, independently certified at Go-Live before SLA clock starts. Emergency Cloud Compute auto-activates upon any primary cluster unavailability — at Verde's cost, not yours.
GPU workload completion logging · error detection and alerting · scheduled maintenance windows · hardware acceptance test at 97% factory benchmark threshold — independently certified by third-party engineer before SLA clock starts (industry norm: self-certification or no defined threshold)
Client workload isolation · TLS 1.3 in transit · AES-256-GCM at rest · BYOK · Hardware-Native TEE available
CCPA/GDPR readiness · data minimization policy · post-engagement deletion with certificate · HIPAA BAA for healthcare
Section C
Committed in the MSA. Roadmap scheduled.
Twenty-seven compliance controls committed in the MSA, delivered or started from contract execution, across nine sectors. ISO 42001 control mapping is delivered under the MSA. SOC 2 and ISO 27001 timelines are committed in the MSA Compliance Schedule.
Sector
Status
Committed in MSAMapping Per MSARoadmap
| Standard / Framework | Status | Description |
|---|---|---|
| OFACFinancialEnterpriseEnergyHealthcareLegalAutomotiveResearchRoboticsBiotech | At Signing | Sanctions screening of Verde personnel and transactions begins at contract execution. Screening conducted at engagement initiation and annually thereafter. |
| EAR / Supply Chain ComplianceEnterpriseAutomotiveEnergyRobotics | Per MSA | Hardware procurement committed exclusively through manufacturer-authorised, EAR-compliant channels. Documented chain of custody from factory to Pacific Northwest facility. |
| NIST SP 800-88FinancialHealthcareLegalEnterpriseResearchBiotech | Per MSA | Media sanitization at engagement end. Certificate of destruction issued within 30 business days. |
| CPRA/CCPA (2026) / GDPR / NY SHIELDFinancialHealthcareLegalEnterpriseResearchBiotechAutomotive | Per MSA | CPRA/CCPA requirements effective 1 January 2026 are addressed under the MSA: mandatory DPIA for high-risk AI processing, Automated Decision-Making Technology transparency notices, Universal Opt-Out (GPC) signal compliance. GDPR Article 83 enforcement is ongoing — cumulative fines exceeding €7.1 billion by mid-2026; dual-regulatory exposure with EU AI Act managed under Verde's integrated governance framework. 72-hour incident notification commitment meets GDPR Art. 33, CCPA, NY SHIELD, and SEC Reg S-P vendor notification requirements. |
| NIST CSF 2.0FinancialHealthcareEnergyEnterpriseLegalResearch | Architecture-Aligned | Board-level cybersecurity governance framework aligned to all six NIST CSF 2.0 core functions: Govern, Identify, Protect, Detect, Respond, Recover. |
| HIPAA BAAHealthcareBiotechResearch | Per MSA | Verde acts as Business Associate for healthcare clients under a BAA executed before go-live. Infrastructure-level technical safeguards are designed in. Verde never accesses, views, or processes PHI directly. |
| Clean-Agent Fire SuppressionFinancialHealthcareEnergyEnterpriseLegalAutomotiveResearchRoboticsBiotech | Per MSA | Clean-agent suppression committed for all compute areas — wet-pipe systems expressly prohibited. Annual licensed engineer inspection certificate provided. |
| SOC 2 (Facility Level)FinancialHealthcareEnterpriseLegal | Facility Operator | Data centre operator holds SOC 2 Type II certification. Operator audit reports available to Verde clients under NDA on request. |
| EU AI ActFinancialHealthcareEnterpriseLegalAutomotiveResearchEnergy | Architecture-Aligned | Article 50 transparency obligations apply from 2 August 2026 — Verde SIEM, PAM, and inference telemetry are architected to support the auditability requirements. Annex III High-Risk AI system compliance architecture is designed ahead of the 2 December 2027 enforcement deadline. Dual-regulatory exposure (GDPR + EU AI Act) managed under Verde's integrated governance framework. |
| WREGIS / Scope 2 Carbon — CSRD / ISSBEnergyEnterpriseFinancial | Per MSA | Quarterly Scope 2 carbon report — WREGIS REC-certified hydroelectric baseload. Audit-ready for CSRD (post-Omnibus I scope, Wave 2 deadline 2028), ISSB S1/S2, California SB 253/261, and EU Energy Efficiency Directive PUE reporting (500 kW+ threshold). 100% renewable energy — not offset credits. |
| NIST AI RMF 1.0FinancialHealthcareEnergyEnterprise | Architecture-Aligned | Verde infrastructure governance aligned to NIST AI RMF 1.0 core functions: Govern, Map, Measure, Manage. NIST AI RMF Profile on Trustworthy AI in Critical Infrastructure (concept note published April 2026) framework observed. Relevant for financial services, enterprise AI, and critical infrastructure clients. |
| SEC Regulation S-P (2024 Amendments)Financial | Regulation in Effect — Dec 2025 / Jun 2026 | In full effect: larger covered institutions (December 3, 2025); smaller entities (June 3, 2026). Requires (1) a written Incident Response Program for unauthorized access to customer information; (2) customer breach notification 'as soon as practicable' and no later than 30 days after becoming aware of a qualifying incident; (3) written policies for service provider oversight and due diligence. Verde's documented IR programme, 30-day customer notification capability, and immutable audit trail architecture meet the IRP and recordkeeping requirements. Applicable for broker-dealers, registered investment advisers, investment companies, and transfer agents. Note: Reg S-P's 30-day customer notification requirement is distinct from Verde's 72-hour incident notification commitment under GDPR Art. 33, CCPA, and NY SHIELD — Verde's standard commitment exceeds both timelines. |
| DORA — EU Digital Operational Resilience ActFinancial | Regulation in Effect — Jan 17 2025 | Binding ICT risk management, incident reporting, and exit-plan documentation requirements for financial entities operating in the EU — including direct contractual obligations on critical third-party ICT providers such as Verde. Verde's DORA-compatible contract framework covers resilience testing, ICT incident reporting (4-hour initial notification, 72-hour intermediate), and documented exit plan. Applicable for EU-regulated financial institutions, insurance, and payment service providers. |
| PCI-DSS v4.0Financial | Architecture Compatible | PCI-DSS v4.0 (mandatory enforcement March 2024) network segmentation, logging, and access control requirements architecturally met. Verde dedicated infrastructure isolates cardholder data environments at the hardware level — no shared nodes, no shared network segments. Applicable for payment processors, financial services clients, and enterprise merchants handling cardholder data. |
| NERC CIP (CIP-002-8 / CIP-003-11)Energy | Architecture Aligned | Verde infrastructure designed to align with NERC CIP isolation, physical security, and electronic access control requirements — including 2026 updates to CIP-002-8 (revised control center definitions) and CIP-003-11 (expanded electronic access controls). Relevant for energy sector, grid operators, ISOs, and RTOs deploying AI. |
| TISAX ISA2027 / ISO/SAE 21434 / UNECE WP.29Automotive | Architecture Compatible | TISAX ISA2027 (mandatory January 2027) maps exclusively to ISO/IEC 27001:2022 and IEC 62443 — removing all ISO/IEC 27001:2013 references. Verde infrastructure access controls, network segmentation, and event logging support TISAX Level 2/3 CSMS requirements. UNECE WP.29 first global driverless ADS regulatory framework adopted June 2026. Applicable for Tier 1/2 automotive suppliers and OEMs. |
| FDA 21 CFR Part 11 / SaMD FrameworkHealthcareBiotech | Architecture Aligned | Electronic records, electronic signatures, audit trails, and access controls meet FDA 21 CFR Part 11 requirements. Infrastructure event logs available for FDA, HHS OCR, or internal compliance review. Infrastructure configuration aligned to FDA Digital Health Centre of Excellence SaMD framework for AI-assisted diagnostic workloads. Applicable for healthcare, life sciences, and medical device clients. |
| Post-Quantum Cryptography — NIST FIPS 203/204/205FinancialHealthcareEnterpriseEnergy | Assessment Available | NIST finalized FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) on August 13, 2024. Verde provides a PQC Readiness Assessment and migration roadmap for clients with forward-looking cryptographic obligations. Active migration programme under way; no 'harvest now, decrypt later' exposure for clients with current-generation BYOK keys. Applicable for financial services, healthcare, and government-adjacent clients with long-data-lifetime requirements. |
| Annual Hardware Valuation CertificateFinancialEnterpriseEnergy | Per MSA | Independent third-party hardware valuation conducted at each engagement anniversary. Certificate issued to client within 30 business days of valuation date — supports insurance claim substantiation, balance sheet audit, and collateral documentation. Part of the IE annual audit scope. Relevant for enterprise clients with fixed-asset reporting, insurance underwriting, and institutional investor obligations. |
| AI Insurance Readiness PackageFinancialHealthcareEnergyLegalEnterprise | Per MSA | Verde delivers a structured AI Insurance Readiness Package at engagement initiation: governance documentation map, infrastructure evidence index, incident response procedures, and BYOK architecture summary — formatted for underwriter submission. Designed to support clients seeking standalone AI liability coverage, cyber policy endorsements, or board-level AI risk disclosures. Aligns to emerging insurer requirements for dedicated AI infrastructure documentation. |
| AI Workload Portability CertificateEnterpriseFinancialHealthcareAutomotiveEnergy | Per MSA | Formal certification issued at go-live confirming that all client AI workloads, model weights, training data, and infrastructure configurations are fully portable — no Verde lock-in at the infrastructure, data, or legal entity layer. Includes documented migration procedures and independent trustee access credentials per RF-09. Supports enterprise procurement requirements, board-level AI governance disclosures, and regulatory obligations under EU AI Act Article 12 (traceability) and DORA exit-plan provisions. |
| EO 14409 / Gold Eagle ClearinghouseEnergyEnterprise | Regulation in Effect — Jun & Jul 2026 | Executive Order 14409 (June 2, 2026) on AI in critical infrastructure establishes procurement and operational security standards for AI deployed in energy, grid, and critical systems. Gold Eagle Clearinghouse (launched July 14, 2026) is the federal AI risk clearinghouse for critical infrastructure operators — Verde infrastructure architecture aligned to Gold Eagle documentation requirements for dedicated AI compute deployed in energy sector workloads. Applicable for grid operators, ISOs, RTOs, and regulated energy clients. |
| ABA Formal Opinion 512 — AI in Legal PracticeLegal | Guidance Issued — Jul 2024 | American Bar Association Formal Opinion 512 (July 29, 2024) establishes competence, confidentiality, and supervisory obligations for lawyers using AI tools. Verde infrastructure supports law firm AI governance obligations: client data isolation prevents cross-matter AI contamination; BYOK architecture means no Verde access to privileged communications or work product; immutable audit log satisfies supervisory documentation obligations; NIST SP 800-88 media sanitization at matter close. Applicable for law firms, corporate legal departments, and legal process outsourcing providers deploying AI on Verde infrastructure. |
| ISO PAS 8800:2024 — AI Safety for Road VehiclesAutomotive | Architecture Compatible | ISO PAS 8800:2024 (published December 2024) is the first international standard specifically addressing AI safety for road vehicles — covering AI system design, validation, and operational safety requirements for vehicle AI workloads. Verde infrastructure isolation, hardware TEE, and immutable audit logging support ISO PAS 8800 evidence requirements for AI training and inference workloads. Complements ISO 26262 Functional Safety and TISAX ISA2027 obligations. Applicable for Tier 1/2 automotive suppliers and OEMs training or validating vehicle AI systems. |
| NIH NOT-OD-25-081 — Controlled Genomic Data + AIResearchBiotech | Architecture Aligned | NIH NOT-OD-25-081 (2025) establishes updated requirements for accessing and computing on controlled-access genomic data from NIH repositories (dbGaP, AnVIL) — including requirements for compute environment isolation, access logging, and data handling for AI/ML workloads. Verde dedicated infrastructure satisfies the compute isolation, no-cross-client access, and audit trail requirements for NIH controlled-access data approvals. Applicable for academic research institutions, biotech, and pharmaceutical organizations with active NIH Data Access Committee approvals. |
| GLBA / FTC Safeguards Rule (2023 Amendments)Financial | Regulation in Effect — June 2023 | FTC Safeguards Rule (16 CFR Part 314), amended effective June 2023, requires financial institutions to implement comprehensive information security programmes — including encryption, access controls, multi-factor authentication, audit logging, and incident response plans. Verde infrastructure satisfies Safeguards Rule technical requirements: AES-256 encryption at rest, TLS 1.3 in transit, MFA-enforced PAM access, SIEM continuous monitoring, and a documented IR programme with 72-hour incident notification. Applicable for non-bank financial institutions, mortgage companies, auto dealers, and fintech firms subject to FTC Safeguards jurisdiction. |
| SOX Section 404 — AI Audit Trail SupportFinancial | Architecture-Aligned | SEC-registered companies using AI in financial reporting workflows require audit trail evidence for AI-assisted controls under SOX Section 404. Verde infrastructure provides immutable, tamper-evident event logs covering all AI inference requests, model version history, and access events — formatted for external auditor review. Verde never modifies or purges audit logs without client consent. Applicable for public companies, registered investment advisers, and fintech firms with SOX obligations. |
| ISO 42001 — AI Management SystemEnterpriseFinancialHealthcareAutomotiveLegal | Mapping Per MSA | An ISO/IEC 42001 Annex A gap analysis and control mapping are delivered to the client under the MSA, starting at engagement initiation. Not a certification. EN ISO/IEC 42001:2026 was published by CEN/CENELEC in March 2026, with national adoption required by September 2026. Any certification scope and timeline is defined in the MSA Compliance Schedule. |
| Parent Holding Master SOC 2 Type IIFinancialHealthcareEnterpriseLegal | Starts at Signing | The Master SOC 2 Type II programme begins at contract execution and covers 24/7 NOC/SOC, PAM, SIEM, DevSecOps, and employee background checks across all five Trust Service Criteria. Scope and timeline are defined in the MSA Compliance Schedule. |
| Client SPV Scope Extension & BridgeFinancialHealthcareEnterpriseLegal | Per MSA | Each client dedicated Delaware SPV is scheduled to receive a SOC 2 Scope Extension Bridge Letter from our CPA firm (T+30 Days from contract execution), extending Holding Master SOC 2 controls to the dedicated cage and BYOK enclave. |
| ISO 27001EnterpriseFinancialAutomotiveHealthcare | Roadmap | Control mapping delivered under the MSA — aligned to ISO/IEC 27001:2022 (the only current valid version since the 2013 transition deadline closed October 2025). Facility operator holds independent ISO/IEC 27001:2022 certification. Verde certification scope and timeline defined in the MSA Compliance Schedule. TISAX ISA2027 (mandatory January 2027) maps exclusively to ISO/IEC 27001:2022. |
| SSAE 18Financial | Roadmap | Financial controls and internal control attestation framework — relevant for institutional counterparties and regulated-sector clients. Aligned with Parent Holding Master SOC 2 Type II architecture. |
ISO 42001 — Delivered Under the MSA · EN ISO/IEC 42001:2026 Published March 2026
Verde's ISO 42001 AI Management System control mapping is a contractual deliverable under the MSA — not a certification. An Annex A gap analysis and AI governance documentation package are delivered to your audit team under the MSA. EN ISO/IEC 42001:2026 was published by CEN/CENELEC in March 2026, with national adoption required by September 2026. It is a voluntary management system standard, not an EU AI Act harmonized standard. Relevant for enterprise AI governance, board reporting, or regulatory disclosure.
Verde Compute · Trust CenterSecurity review
Security review
available
on request.
Our team walks through each trust layer with your CISO, legal, and procurement teams before contract execution. Compliance documentation, insurance certificates, and architecture detail are available under NDA at any stage of your evaluation. No commitment required.