Skip to main content
  • Primary-source verification
  • Human-reviewed workflows
VeriCam Global
Security · governance · verification integrity

Security and governance infrastructure for credential verification operations.

Verifying credentials means handling identity documents, academic records and consent forms. VeriCam runs every case through a governed lifecycle — encrypted intake, officer review, primary-source institutional confirmation, supervisor approval and tamper-evident issuance — each step audit-preserved with actor identity.

Encrypted in transit and at restTwo-person issuance ruleNo documents on public recordsAudit-preserved lifecycleEN · FR bilingual policy
Governance lifecycle

Verification governance, end to end.

Every verification case moves through eight controlled stages. Each stage has a named actor, a documented control, and an audit entry.

  1. 01
    Applicant submission
    ActorSubmitter
    InternalAuthenticated session · consent recorded
  2. 02
    Encrypted intake
    ActorVeriCam platform
    InternalTLS in transit · SHA-256 hashed · audit-logged
  3. 03
    AI-assisted extraction
    ActorExtraction worker
    InternalTriage only · never adjudicates
  4. 04
    Officer review
    ActorVerification officer
    InternalEvidence-first · role-scoped access
  5. 05
    Institution outreach
    ActorVeriCam compliance + registrar
    InternalPrimary-source · published-channel-only
  6. 06
    Supervisor approval
    ActorSupervisor
    InternalTwo-person rule before issuance
  7. 07
    Tamper-evident report issuance
    ActorVeriCam Global, L.L.C.
    InternalCryptographic verification ID · audit-preserved
  8. 08
    QR re-verification
    ActorAnyone in possession of the report
    PublicPublic authenticity portal
Platform pillars

Six pillars of platform security.

Cryptography, access, audit, integrity, file safety and consent — six controls that compose VeriCam's security baseline. Each applies across every engagement model.

Cryptography
Encrypted data protection

TLS 1.2+ in transit; encrypted at rest in object storage. Document hashes (SHA-256) recorded at intake.

Access control
Role-scoped institutional access

Submitter, officer, supervisor, registrar, admin and viewer roles segmented by operational scope. Least-privilege defaults.

Auditability
Audit-preserved workflows

Every action — login, decision, contact, document, issuance, revocation — timestamped with actor identity, IP and request metadata.

Integrity
Tamper-evident issuance

Reports carry a cryptographically derived verification ID, machine-checkable metadata and a public QR re-verification page.

File safety
Malware scanning at intake

Uploads are virus-scanned before they can be referenced in verification. Infected files are quarantined; audit trail preserved.

Consent
Consent-bound disclosures

Applicants explicitly authorise release to a named recipient. Consent records are tied to the case and revocable until issuance.

Verification integrity

Integrity safeguards specific to credential verification.

Cybersecurity protects the platform. Verification integrity protects what the platform attests. These are the controls that make a VeriCam report defensible — to adjudicators, in audit, and against fraud.

Read methodology Anti-fraud policy
  • Primary-source institution confirmation

    No report is issued without a documented contact with the issuing institution through a published official channel.

  • Officer-reviewed outcomes

    AI extraction assists triage; the adjudication is always performed by a human verification officer.

  • Supervisor approval workflows

    Two-person rule: a supervisor reviews and approves the officer's decision before any report can be issued.

  • Revocation and supersession controls

    Reports can be revoked (withdrawn) or superseded (replaced) post-issuance. Both states are public and audit-logged.

  • QR re-verification

    Any party in possession of a report can re-verify it live against the public authenticity portal at any time.

  • Fraud escalation handling

    Suspected-fraud cases route into a dedicated compliance review. Disavowals are preserved and protect institutional integrity.

Operational governance

Procedural controls behind every report.

Beyond cryptography — the operational rules that turn a security platform into a governable verification authority.

  1. 01
    Manual institution onboarding

    Cameroonian institutions are accreditation-verified by a compliance officer before any registrar account is provisioned.

  2. 02
    Role-segmented staff access

    Verification officers, supervisors and admins operate from least-privilege defaults. Privilege escalation is audit-logged.

  3. 03
    Supervisor approval before issuance

    No officer can issue a report without a separately authenticated supervisor approval — enforced at the data layer.

  4. 04
    Suspicious-case escalation

    Cases flagged as suspected fraud are queued for compliance review. Escalation, disposition and rationale are all preserved.

  5. 05
    Audit-preserved verification history

    The full lifecycle of every case is retained: submission, extraction, response, decision, issuance, revocation.

  6. 06
    Bilingual policy enforcement

    All policy, consent and verification artifacts are produced and audited in English and French — Cameroon's working languages.

Disclosure boundary

What is public — and what never is.

The public authenticity portal exposes the minimum required for adjudication. Everything else stays server-side, accessible only to authorised parties on the case.

Publicly disclosed on the verification record
8 fields
  • Verification ID
  • Validity state (VALID / EXPIRED / REVOKED / SUPERSEDED)
  • Verification outcome (VERIFIED / PARTIALLY_VERIFIED / NOT_VERIFIED / UNABLE_TO_VERIFY)
  • Issuing institution
  • Credential category
  • Graduation / award year
  • Issuance date · expiry date
  • Masked applicant initials
Never publicly disclosed
8 fields
  • Uploaded documents (certificate, transcript, ID)
  • Full applicant name and date of birth
  • Passport / national ID numbers
  • Full transcripts and detailed grades
  • Internal institutional communications
  • Officer notes and internal evidence
  • AI extraction raw outputs
  • Case audit trail (visible only to authorised parties on the case)

Uploaded documents, transcripts, identity numbers and internal evidence are never publicly exposed. Internal evidence is visible only to authorised case participants — submitter, assigned officer, supervisor, registrar — and only for the lifetime of the case under the published retention policy.

Security operations

Infrastructure-level safeguards.

Production deployments run on encrypted object storage, isolated infrastructure and audit-logged administrative access.

Dedicated production infrastructure

Production tenants run on isolated infrastructure with managed-service backups and point-in-time recovery.

Encrypted object storage

Document storage uses provider-managed server-side encryption (Cloudflare R2) with audit-logged access.

Restricted administrative access

Production admin access is role-scoped, MFA-gated and limited to a named operations cohort.

Secure deployment pipelines

All releases ship through reviewed pull requests and CI; secrets never leave the secret manager.

Security event monitoring

Authentication anomalies, privilege changes and bulk data access generate alerts to the compliance team.

Database access controls

Application-level access is role-checked at every query; direct database access is restricted and audit-logged.

Governance maturity

Independent security review and operational testing.

  • Pre-launch security review — Independent assessment of platform controls scheduled before each major production release.
  • Penetration testing — Third-party offensive testing of public-facing surfaces and authenticated workflows.
  • Procurement questionnaires — Completed for enterprise engagements; SIG / CAIQ / VSA available on request.
  • Two-factor authentication — Supported across all staff and institution roles; required on enterprise plans.
  • Retention policy — Published and applied uniformly; applicants can request deletion subject to legal holds.
Security & compliance contact

Disclose, review, or audit our controls.

Dedicated channel for vulnerability disclosure, security reviews, compliance documentation and procurement questionnaires. Responses from a named compliance officer within one business day; security-incident reports escalated immediately.

[email protected] [email protected]
  • ·Vulnerability disclosure. Coordinated disclosure with a 90-day default window.
  • ·Compliance reviews. DPA, retention, sub-processor list, SIG / CAIQ on request.
  • ·Procurement questionnaires. Completed for enterprise engagements with NDAs in place.
  • ·Legal / security requests. Routed to compliance with a documented audit trail.
Security & governance · VeriCam