Customer playbook C

Records that answer “show me”

Vericode preserves the verification evidence. Your firm preserves the program, training, incident, and fallback records around it.

Read the retention policy

Who keeps what

Use both columns when preparing for an audit. Vericode’s record supports the control; the firm’s records show how that control sits inside its wider compliance program.

No staff effort

Vericode keeps automatically

Each verification event: timestamp, channel, masked destination in the compliance-facing verification record, outcome, staff member, and workspace
An append-only, hash-chained history for authorised-contact register events, hosted in Australia
Authorised-contact audit events retained for seven years to support AML/CTF record keeping
Exports available through the audit-trail export, check certificate and quarterly records pack. They record the check and its outcome; they do not certify identity or compliance

Your obligations

The firm keeps

Your AML/CTF program document and telephone CDD procedure
Your staff training register
Your incident register and external-report references
Manual fallback records created during an outage, kept with the matter file, following Playbook A

Masking scope: the destination is masked in the verification record shown to your compliance officer and in customer-facing evidence. This is not a claim that every internal operational log contains only masked data.

Published retention and deletion policy

Authorised-contact audit events have a seven-year retain-until value. That record survives staff changes because it is workspace-owned. Handling for other information follows the policy below without inventing an unsupported fixed period.

When a staff member leaves

Verification records belong to the workspace, not the individual user. They remain available to authorised workspace members after the departing person’s access is removed.

When a subscription is cancelled

Billing stops and the workspace's records stay available to export. To have them deleted, the workspace owner closes the workspace.

When the owner closes the workspace

The owner chooses Settings, then Close workspace. The subscription is cancelled, staff, Sidekick and API keys lose access, and the owner keeps read-only access for 30 days to export records. After 30 days the workspace data is deleted. Kept: authorised-contact and verification audit events until their seven-year retain-until date (masked numbers, never full mobiles), billing records for tax purposes, and the record that the firm accepted the Terms.

When deletion is requested

Anyone else, or an owner who can't sign in, can send the request to privacy@vericode.com.au. Vericode assesses the request against applicable legal and operational retention obligations, confirms what can be deleted, and explains any record that must be retained.

Other record classes

Billing, account, support, and general workspace information are retained and deleted as described in the Privacy Policy. No fixed period is claimed here where one has not been published.

The audit answer

Export the verification evidence, then produce the firm-owned program, training, incident, and fallback records that explain how staff used the control.

Not legal advice. This operational guide does not replace advice on your firm’s AML/CTF, privacy, professional, insurance, or record-keeping obligations.

Outage playbook Fraud playbook Escalation matrix Verification evidence