Data handling
How we handle claim photos and account data
Last updated: September 11, 2026
Verified Capture exists to prove a photo has not been altered. That only works if the photo is handled carefully, so this page states plainly what we collect, where it is stored, who can see it, and how long we keep it.
1. Who we are
This service is operated by Verified Capture LLC, a Florida limited liability company. Questions, access requests and deletion requests go to support@verifiedcapture.io.
2. Two groups of people use this service
The distinction matters, because the data and the rights are different for each.
- Claimants. People who take a claim photo using a capture link sent to them by an insurer or adjusting firm.
- Firm users. Adjusters and administrators at a client firm who sign in to the dashboard to review, verify and export claims.
For claimant data, the client firm decides what is collected and why. We process that data on the firm's behalf and under its instructions, as a service provider. If you are a claimant and you want your photo removed, contact the firm handling your claim. You may also contact us and we will pass the request to them.
3. What we collect at capture
When a claimant submits a photo, the capture page sends us only the following:
| Data | Why |
|---|---|
| Full name and policy number, as typed by the claimant | To bind the photo to a specific claim so the adjuster can match it to a file |
| The photo itself | The evidence being sealed |
| Capture timestamp reported by the device, and the time we received and signed it | Part of the signed record |
| Browser user agent and window size | Recorded in the signed manifest as capture context |
| IP address | Used only to enforce rate limits and stop abuse. It is not written into the claim record |
We do not collect location data, contacts, device identifiers, or anything from the claimant's photo library. The capture page sets no cookies and carries no advertising or analytics trackers.
The photo never touches the device's storage
There is no file picker and no upload control anywhere in the capture flow. The photo is taken from the live camera stream, held in memory, sent directly to our server, and then cleared. It is not saved to the camera roll, and a previously saved or generated image cannot be submitted through this flow.
4. What we collect from firm users
- Name, work email address and role, entered by the firm or during signup.
- A password, stored only as a scrypt hash with a unique salt. We never store or email the password itself. Temporary passwords are shown once on screen and are never sent by email.
- A session cookie, which holds a random token and nothing else. It is HttpOnly, restricted to our own site, and expires after seven days.
- An activity log of actions taken in the account: sign ins, photo views, integrity checks, exports, and team changes. This is the chain of custody record, and it is what makes an export defensible.
5. How photos are protected
- Every photo is fingerprinted with SHA-256 at the moment it arrives, and that fingerprint is bound to the claimant, policy and timestamp in a manifest signed with an Ed25519 key held only on our server.
- Photo files are written to private server storage with restricted file permissions. They sit outside the public web directory, so no public link to a claim photo exists.
- Photos are served only through an authenticated request from a signed in user at the firm the claim belongs to. Every view is written to that firm's activity log.
- Each firm's data is scoped to that firm. A user at one firm cannot query, view or export another firm's claims.
- All traffic runs over HTTPS.
6. Where the data lives, and who else touches it
Claim photos and account records are stored on a private cloud server in the United States, with automated daily backups.
We rely on a small number of vetted service providers for hosting and for operational email. Our hosting provider stores the data but does not access or use it. No other provider receives claim photos. A current list of these providers is available to client firms on request.
What we never do
We do not sell data. We do not share claim photos or claim details with advertisers, data brokers, or any other customer. We do not use claim photos, claimant details or account data to train artificial intelligence models, ours or anyone else's. We disclose data outside the firm that owns it only if we are legally required to, and we will tell that firm unless we are barred from doing so.
7. How long we keep things
| Record | Retention |
|---|---|
| Claim photos and signed manifests, live accounts | Kept for as long as the account is active, because they are evidence the firm may need later. Deleted on the firm's written request |
| Claim photos in the public demo | Deleted automatically within 24 hours. Demo records are sample data and are marked as non attestations |
| Closed or cancelled accounts | Deleted within 30 days of a written request from a firm administrator. Tell us before you cancel if you want an export first |
| Activity log | Retained for the life of the account. It is the chain of custody record and entries are never edited |
| User accounts | Deactivated rather than deleted, so the activity log stays intact and readable |
| Backup snapshots | Deleted data can persist in backups for a short period until those snapshots roll off |
8. Exports leave our control
An export package contains the photo, the signed manifest, the signature, our public key and a printable receipt. Once a firm downloads it, that copy is in the firm's hands and is governed by the firm's own retention and security practices, not ours.
9. Your requests
Firm administrators can request an export, correction or deletion of their organization's data by emailing support@verifiedcapture.io from their account email address. We respond within 30 days. Claimants should contact the firm handling their claim, since that firm controls the record.
Depending on where you live, you may have rights to access, correct, delete or obtain a copy of your personal data. We honor these requests regardless of where you live.
10. Children
Verified Capture is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 13. If you believe a child's data reached us, email us and we will remove it.
11. Changes
If this statement changes in a way that materially affects how claim data is handled, we will update the date at the top of this page and notify account administrators by email.
12. Contact
Verified Capture LLC
support@verifiedcapture.io