Article 3
GDPR can apply outside Europe in defined circumstances, including offering goods or services to, or monitoring the behaviour of, people in the EEA.
Australian by design
AU-hosted, GDPR-aware, and honest about the boundary.
Vericode is built for Australian law first. Data minimisation, a named hosting jurisdiction and limited verification records can help a multinational assess the service without turning that into a blanket GDPR-compliance claim.
The straight answer
Australian residency is the architecture, not a fallback.
Customer and verification data (recipient details, messages and verification records) is hosted in Australia. Staff sign-in is handled by our identity provider, WorkOS, in the United States; see the data-residency page for subprocessor information.
There is no EU hosting region today. For many Australian firms and multinational procurement teams, one declared primary jurisdiction makes review clearer. It does not remove the need to assess transfers, contractual roles or the law applying to people in the EEA or UK.
Current assurance status
Vericode does not currently hold an independent information-security certification. Formal certification work is planned; provider certifications belong to the provider and are not Vericode certifications.
Verification evidence, not client files. The service stores the limited metadata needed to send and evidence a verification, not a repository of client matter files. Minimising what enters the system reduces the data under review.
When GDPR may enter the picture
Location is one question; territorial scope and roles are others.
Recipient context
An Australian customer may verify a person in the EEA or sit within a multinational group. That fact should trigger a scoped assessment, not an automatic conclusion.
Controller and processor roles
The parties must identify their roles and instructions for the engagement. Vericode does not publish one universal allocation for every customer and use case.
Rights mapping
Similar outcomes, different legal foundations.
This comparison is an orientation aid, not a statement that the regimes are interchangeable.
APP 12 ↔ GDPR Article 15
Access
Request access to personal information Vericode holds about you.
APP 13 ↔ GDPR Article 16
Correction
Request correction of inaccurate, out-of-date, incomplete, irrelevant or misleading information.
APP 11.2 ↔ GDPR Article 17
Deletion
Australian law has no direct right-to-be-forgotten equivalent. Vericode deletes or de-identifies information when no longer needed, subject to legal and operational retention obligations.
Available today
Bring the engagement; request the scoped material.
DPA review
A DPA is available on request and remains pending legal review. It is not yet published as standard website terms. Contact [email protected] with the intended data flow and jurisdictions.
Subprocessor detail
The public subprocessor list names each provider, what it handles and where it operates, and is updated when a provider changes.
Procurement questions
Continue the assessment.
General information only. This page is not legal, privacy-compliance or regulatory advice. Confirm obligations with the applicable regulator and seek professional advice for the engagement. Vericode supports a limited verification control; it does not replace a controller's or processor's compliance program or discharge either party's obligations.