Legal Notice,
Privacy Policy and Cookies.

Corporate Policies in PDF

Review the public versions of our privacy, management, and information security policies.

POL-GDPR-02 · Version 1.1 · October 22, 2026

Privacy Policy

Information on the processing of personal data and the exercise of rights.

View PDF↗ Check the V-Seal™ seal ↗

POL-SGI-01 · Version 1.1 · October 22, 2026

Integrated Policy

Commitments to quality, information security, and data protection.

View PDF↗ Check the V-Seal™ seal ↗

POL-SEG-01 · Public Version 1.0 · October 22, 2026

Information Security Policy

Security commitments in accordance with ENS (medium category) and ISO/IEC 27001:2022.

View PDF↗ Check the V-Seal™ seal ↗

Legal Notice and Terms of Use

Website Title

In compliance with Article 10 of Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE), we hereby provide the following information:

1. Scope of Application

This document governs the terms of use, access, and navigation of the main website and the digital ecosystem associated with the V-PROOF Protocol. It applies to:

• Main, commercial, and informational website: www.vproof.io
• Geographic and redirect domains owned by us that redirect to the main website, including, among others: vproof.eu, vproof.ai, vproofprotocol.com, vproofprotocol.es, vproofprotocol.cat, vproofprotocol.eu, vproofprotocol.de, vproofprotocol.fr, and vproofprotocol.uk.
• Technical ecosystem, application, and subdomains intended for software use, platform access, developer portal, API, and protocol backend, among others: vproofprotocol.io, vproofprotocol.tech, vproof.io, app.vproof.io, backend.vproof.io, and support.vproof.io.

Accessing and browsing any of these websites confers the status of user and implies acceptance of this Legal Notice. The processing of personal data and the use of cookies are governed by the Privacy Policy and the Cookie Policy in Sections II and III, which are provided for informational purposes; non-essential cookies are used only if you give your consent. Customers’ use of the platform is also governed by the applicable service agreement, which takes precedence over this document in the event of any conflict.

2. Nature of the Service and Limitation of Liability

V-PROOF Protocol provides cryptographic infrastructure for the traceability and anchoring of evidence related to digital assets, including those generated by artificial intelligence and human authorship. The evidence it generates allows for the verification of the technical integrity and timestamp of the sealed asset; it does not attest to the veracity of its content, the identity of the contributor beyond what is recorded, or the client’s regulatory compliance, the assessment of which is the responsibility of the competent authority in each case.

V-PROOF Protocol does not provide legal advice and is not responsible for the origin, content, or use that the customer makes of the assets at sealed through its infrastructure, without prejudice to any liabilities that the law does not permit to be excluded.

3. Intellectual and Industrial Property

V-PROOF PROTOCOL® is a registered trademark of V-PROOF PROTOCOL, S.L., a subsidiary of Vertically.

All rights to the software, architecture, content, documentation, trademarks, logos, and design of this website belong to V-PROOF PROTOCOL, S.L. or its licensors, and are protected by intellectual and industrial property laws. Reproduction, distribution, or use without express authorization is prohibited.

The use of the name, logo, V-Seal™, or the phrase “Verified by V-Proof” on any asset, document, or platform is prohibited without an active license and a valid contract.

All other trademarks and trade names mentioned on this site belong to their respective owners and are mentioned solely for informational purposes; this does not imply any affiliation or endorsement.

4. Data sovereignty and local fingerprint

The infrastructure is designed based on the principle of data sovereignty:

• During the sealing process, the document's cryptographic fingerprint is calculated in the client environment (Desktop Agent, Word Add-in, or the client's own system via the API). The V-PROOF Protocol receives the fingerprint and compliance metadata, not the document's content.
• In modules that work with content provided by the client, such as Code Governance—which analyzes code repositories—or V-Proof AI, V-PROOF Protocol treats that content as a data processor, acting solely in accordance with the client’s instructions and under the terms of the contract and the corresponding Data Processing Agreement (DPA). When a module uses a language model, it does so through the provider that the client contracts and configures using their own account; V-PROOF Protocol does not determine which provider that information is sent to.

Technical information on data residency, security, and certifications is available under " Trust and Security."

5. Use of the Site, Links, and Modifications

The user agrees to use the site in accordance with the law and these terms and conditions, and not to use it for any illegal activities or activities that may harm V-PROOF Protocol or third parties. Links to third-party sites are provided for informational purposes only; V-PROOF Protocol does not control or assume responsibility for their content. These terms and conditions may be updated; the current version is the one published on this page, along with its last update date.

6. Applicable Law and Jurisdiction

These terms and conditions are governed by Spanish law. For any dispute arising from the use of this website, the parties agree to submit to the courts and tribunals of the city of Barcelona, unless applicable law mandates a different jurisdiction.

Privacy Policy

1. Data Controller

2. Data Protection Officer

V-PROOF Protocol has appointed a Data Protection Officer (DPO) in accordance with Articles 37 through 39 of the GDPR and Articles 34 through 37 of the LOPDGDD:

You may contact the Data Protection Officer (DPO) regarding any questions about the processing of your personal data and the exercise of your rights.

3. What data we process, for what purpose, and on what legal basis

The fields marked as required on each form are necessary to process your request; if you do not provide this information, we will not be able to process it. We do not make decisions based solely on the automated processing of your data that produce legal effects on you or significantly affect you.

The data processed on the platform on behalf of clients is not governed by this policy, but rather by the service agreement and the data processing agreement (DPA) signed with each client.

4. Recipients and Data Processors

We do not share your data with third parties unless required by law. The following categories of vendors have access to your data as data processors under contract:

• Website hosting, forms, and built-in analytics: Squarespace.
• Web analytics: Google (Google Analytics), only if you consent.
• Email and customer relationship management providers.

With regard to the data collected by the LinkedIn Insight Tag, V-PROOF Protocol and LinkedIn Ireland Unlimited Company act as joint data controllers only if you give your consent. V-PROOF Protocol is responsible for informing you and obtaining your consent; LinkedIn is responsible for the subsequent processing it performs using its own resources, as described in its privacy policy. You may exercise your rights with either of them.

5. International Transfers

Some of the listed providers are headquartered in the United States or have part of their infrastructure there, so the processing may involve data transfers outside the European Economic Area. These transfers are covered by the provider’s adherence to the EU-U.S. Privacy Shield or, failing that, by the Standard Contractual Clauses approved by the European Commission.

6. Your Rights

You may exercise the following rights at any time:

• Right of Access: Find out what personal data we process about you.
• Correction: Correcting inaccurate information.
• Deletion: Request that your data be deleted.
• Objection: to object to a specific processing activity, including one based on a legitimate interest.
• Restriction: Request that we temporarily suspend the processing.
• Data portability: receive your data in a structured format.
• Not to be subject to automated individual decision-making, including profiling, that has legal effects or significantly affects you.
• You may withdraw your consent at any time, without this affecting the lawfulness of the processing that took place prior to the withdrawal.

To exercise these rights, please write to david@vproof.io or info@vproof.io, specifying the right you wish to exercise. There is no charge for exercising these rights, and we will respond within one month, which may be extended in the cases provided for in Article 12.3 of the GDPR. If we have reasonable doubts about your identity, we may ask you for the additional information necessary to confirm it.

If you believe we have not properly addressed your request, you may first contact the Data Protection Officer (DPO) and, in any case, file a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Minors

This site is intended for professionals and organizations. We do not knowingly collect data from children under the age of 14 (Art. 7 of the LOPDGDD).

8. Safety

We implement technical and organizational measures appropriate to the risk to protect your data. Once the retention period has expired, the data is securely deleted.

Cookie Policy

To ensure the site functions properly and to understand how executives and the organizations that visit it use it, we use the following technologies:

Technical cookies, strictly necessary

The hosting platform uses them for security, traffic routing, basic site functionality, and to remember your preferences, including your cookie settings. Since they are essential, they do not require consent.

Performance and Analytics Cookies · Squarespace and Google Analytics

They measure traffic volume and browsing behavior on an aggregate basis to determine which content generates the most interest. The hosting platform (Squarespace) uses its own analytics, and Google Analytics—which is a third-party cookie—is also installed. These are only activated if you give your consent.

Advertising and Campaign Measurement Cookies · LinkedIn Insight Tag

These are third-party cookies. We use them solely to track conversions: to determine which LinkedIn campaigns drive visits and inquiries, and to gather aggregate professional profile information about those visitors, such as industry or job title. We do not use them to create retargeting audiences or to show you personalized ads. They are only activated if you consent. See section 4 of the Privacy Policy regarding our joint responsibility with LinkedIn.

Consent Management

In accordance with the GDPR and the LSSI-CE, analytics and advertising cookies are only installed after you have given your express consent via the cookie banner. You can accept, reject, or choose which ones to accept at any time—just as easily as you gave your consent—by clicking the “Cookie Preferences” link at the bottom of each page. You can also delete them from your browser settings.

International data transfers involving these tools are described in Section 5 of the Privacy Policy.

Information Security Policy

POL-SEG-01 · Public Version 1.0 · October 22, 2026 · National Security Framework (RD 311/2022) · ISO/IEC 27001:2022. Download PDF ↗

1. Management Statement

V-PROOF PROTOCOL, S.L. provides the V-PROOF platform, an AI-powered document management service that generates cryptographic evidence of the authorship and integrity of documents, delivered as a SaaS solution. The information we process—both our own and, above all, that entrusted to us by our clients—is a strategic asset.

Management is committed to protecting it through an Information Security Management System aligned with the National Security Framework (Royal Decree 311/2022) and the ISO/IEC 27001:2022 standard, equipped with the necessary resources and subject to independent audit. This policy expresses that commitment and serves as the framework from which the organization’s policies, procedures, and internal controls are derived.

2. Security Mission and Scope

V-PROOF’s security mission is to ensure that the evidence generated by the platform is complete and authentic, that the customer documentation in its custody remains confidential, and that all actions taken on the system are traceable, with the contractually agreed-upon level of availability.

This policy applies to all information processed by V-PROOF PROTOCOL, S.L., the systems that support it, and all individuals who access them: partners, employees, collaborators, and suppliers. The information system that provides the V-PROOF service is classified under the ENS as MEDIUM, and pursuant to Article 2.3 thereof, this policy applies to services provided to public sector entities.

3. Principles

Every security-related decision is aimed at safeguarding the following aspects of information:

• Confidentiality: The information is accessible only to those authorized to view it.
• Integrity: The information remains accurate and complete, and any alterations are detectable.
• Availability: Information and services are accessible when needed.
• Traceability: Actions taken on the information are recorded and can be attributed to the person who performed them.
• Authenticity: The identities of users and systems can be verified.

It is governed by the basic principles of the ENS: security as a comprehensive process; risk-based security management; prevention, detection, response, and preservation; the existence of lines of defense; continuous monitoring and periodic reassessment; and the differentiation of responsibilities.

4. Commitments

The management of V-PROOF PROTOCOL, S.L. is committed to:

• Identify, inventory, and protect information assets according to their value and classification.
• Analyze risks systematically and periodically, and address them with proportionate measures, as documented in the ENS Statement of Applicability and the ISO/IEC 27001 Statement of Applicability.
• Comply with applicable laws and regulations, in particular the National Security Framework, the General Data Protection Regulation, Organic Law 3/2018, regulations governing information society services, the eIDAS Regulation, and the European Artificial Intelligence Regulation.
• Control access to information based on the principle of least privilege, using individual identification, strong authentication, and periodic review of permissions.
• Apply security by design throughout the software lifecycle and service operation, including artificial intelligence and distributed ledger components.
• Protect information through encryption in transit and at rest, and through controlled management of keys and secrets.
• Monitor and track system activity to detect, analyze, and respond to security incidents, and notify the authorities and those affected when appropriate.
• Maintain business continuity and disaster recovery plans that are appropriate for the SaaS model, and test them periodically.
• Require suppliers and third parties with access to the information to provide equivalent security safeguards, formalized in a contract.
• Train and educate all staff on data security and protection, and require them to comply with internal policies.
• Continuously review and improve the management system through indicators, internal and external audits, and management reviews.

5. Security Organization

V-PROOF PROTOCOL, S.L. has designated the roles provided for in Article 11 of Royal Decree 311/2022 (Information Officer, Service Officer, Security Officer, and System Officer), distinguishing between responsibility for security and responsibility for system operations, and has appointed a Data Protection Officer, as reported to the Spanish Data Protection Agency.

The Security and Privacy Committee, chaired by the General Directorate, coordinates security efforts: it approves the system classification, the Statement of Applicability, the risk analysis, and the compliance plan; resolves conflicts among data controllers; reviews security indicators; and meets at least once every quarter.

Safety documentation is organized into policies, safety regulations, operating procedures, and records, under a document control system that ensures their approval, review, and controlled distribution.

6. Obligations of Individuals

All individuals with access to V-PROOF systems must be familiar with and comply with this policy and the security regulations that implement it, use resources appropriately, protect the credentials assigned to them, and promptly report any security incidents or vulnerabilities they detect. Failure to comply may result in disciplinary or contractual measures in accordance with applicable law.

7. Compliance, Auditing, and Review

The system’s compliance with the ENS is verified through a security audit conducted by an accredited body at least once every two years, and the management system’s compliance with ISO/IEC 27001 is verified through a certification audit. This policy is reviewed at least once a year, or whenever there are significant changes to the organization’s context, the services provided, the risks, or the applicable regulations.

8. Contact

Questions regarding this policy and communications related to information security or data protection may be directed to dpo@vproof.io or to the company's mailing address.

Public version approved by the General Directorate upon the recommendation of the Head of Security. The complete internal version (POL-SEG-01 v1.1) and the regulations implementing it are provided to clients and auditors under a confidentiality agreement.

V-PROOF PROTOCOL, S.L. · Tax ID No. B26964122 · Carrer de la Riera 18, ground floor, 08500 Vic (Barcelona) · info@vproof.io