Vera Applies Document Controls as a Service

Six E-Signature Security Requirements for Digital Transactions

Looking to change the way security is applied and managed at the document level, Vera today launched a service that allows users to attach permissions to documents and files that stay with them regardless of where the files are sent.

Vera CEO Ajay Arora says the service, formerly known as Veradocs, works by enabling end users to create a micro container through which a set of permissions can be attached by either the end user or the internal IT organization. As those files and documents are shared both inside and outside of the organization, Vera enforces the permission using a metadata wrapper technology the company has developed for that express purpose, says Arora.

In effect, Arora says Vera is creating a data security fabric that enables organizations to hold users more accountable for the security permissions applied to any document or file. In that context, IT organization can set general policies, but it would be up to individual users to take responsibility for not only controlling who gets to access files and documents, but also under what circumstances.

Arora notes that the Vera service itself never stores any documents or files; all it does is enable encryption to be applied and then functions as a control plane that tracks those permissions. The end result is a more secure environment that doesn’t require IT to impose a heavy-handed security framework that is difficult to deploy and maintain, says Arora.

The internal IT organization, says Arora, does get access to encryption keys that allow them to view any documents that have been encrypted, so it becomes the purview of the end user to determine what level of security is appropriate for any given document or file. Arora adds that Vera will offer commercial and later on freemium instances of the service.

For a long time, internal IT organizations have solely borne the brunt of responsibility for document security. While the Vera service doesn’t absolve IT of that responsibility, it does create a mechanism for sharing that responsibility at a time when the network perimeter itself is increasingly becoming indefensible.