Do I need an Anthropic API key? Only for LLM-written policies and answers. Without one, Veriflow still works: policies come from a structured template filled with your data, and answers come from a keyword matcher against your controls. Everything is clearly marked.
Is my data used to train models? No. Content is sent to Anthropic's API for generation only, subject to their API data-handling terms.
Can other Veriflow customers see my answers? No. The answer bank is strictly per-organization. Cross-tenant sharing would leak one customer's security posture into another's questionnaire.
What file formats can I upload?
.xlsx, .xls, .csv, .tsv, .pdf, .txt — up to 10 MB and 100 questions per document. Or paste questions directly.
What if question detection misses some? Switch to Paste questions and paste one per line. Detection looks for question marks and interrogative openings, which most real questionnaires use.
Can I edit generated answers? Yes, and you should. Click Edit, rewrite, save. The answer is marked owned by you and exports at high confidence.
Who owns the generated documents? You do. Policies, answers, and exports are yours.
Why is my score not 100%? Almost always unapproved policies or no evidence run — those are 25% each. See How the readiness score works.
Why did a control turn red? It's contested: marked implemented while failing tests map to it. See Work through your control checklist.
Do I have to run tests in CI? Not to start — ingest the sample run to see the mechanics. But claiming controls with no evidence caps your score and won't stand up to a reviewer.
How often should I run adversarial tests? Weekly if you ship often; monthly is the floor. Evidence older than a month starts looking stale.
Can I run multiple agents on Core? No, multiple agents are a Scale feature. Core covers one agent.
Can I turn off the public trust page? Yes — toggle it off under Trust center and the URL 404s.
Is Veriflow a certification? No. It reports readiness against an AIUC-1-aligned control set. Certification requires an auditor; see the Auditors section.
What's the demo access code for?
It opens a fully seeded sandbox at /demo so you can explore both tiers without connecting anything. Sample data only.