Verkada Inc.
Round 1 · Operational Triage · Operational Triage — Round 1 · assessed
🟠 Insufficient — Request Data-Processing Agreement
Privacy score 90.0% · band Good
This reads as a general website privacy policy, not a data-processing agreement: 10 of 18 questions are simply not addressed. That's a wrong-document signal, not a vendor judgment — the 90.0% reflects silence, not bad practice. Enterprise vendors' real assurance lives in their DPA, a security cert (e.g. ISO 27001), or a completed questionnaire. Request those and assess in Round 2. Coverage note: the policy addresses 8 of 18 questions (44%); a vendor cannot reach the Best band below 70% coverage.
Unaddressed gate(s): Q7, Q13, Q16 — not covered by the public policy. Confirm before relying on this.
Quote check: 12 of 12 quotes found in the vendor's document. Code compares every quote with the text that was read. No model takes part in this check.
Q4, Q5, Q6, Q8, Q11, Q18: the quote joins separate passages with "...". Every part is in the document.
Dimension scorecard
| Dimension | Score | |
|---|
| Data Collection |
| 100.0% |
| Purpose & Use GATE |
| 60.0% |
| Data Sharing GATE |
| 100.0% |
| Data Sold GATE ⚠ | n/a | — |
| Data Rights |
| 100.0% |
| Retention | n/a | — |
| Data Security |
| 100.0% |
| Breach Notice | n/a | — |
| Biometrics & Surveillance GATE ⚠ | n/a | — |
| Payments | n/a | — |
| AI & Model-Training GATE ⚠ | n/a | — |
| Jurisdiction & Residency |
| 100.0% |
| Contract & Assurance |
| 100.0% |
Findings — 19 questions, every answer cited
Data Collection
Q1Does the vendor limit collection and use of staff personal information to what the service needs?
? Not addressed
T0
Answer: Unclear
Policy does not explicitly state that collection and use of staff personal information is limited to what the service needs. General statements about 'purpose limitation' and 'data boundaries' for physical security data are present, but no specific commitment to minimization of staff data collection.
Q2Does the vendor name the categories of sensitive staff data it holds (government ID or SSN, bank details, health or benefits data, biometrics)?
✓ Good
T3
Answer: Yes
“We may also collect access and security-related information, such as audio recorded through intercom systems, video images captured by security devices, building access credentials, and associated system metadata. Where permitted by applicable law (and subject to any notice or consent requirements), we may also process biometric information for access control or demonstration purposes, such as when using products like Face Pass or Face Unlock.”
Policy names biometric information (faces for Face Pass/Face Unlock) and video/audio data as sensitive categories held.
Purpose & Use
Q3Does the vendor commit to use the school's data only to provide the contracted service, and not for its own purposes? GATE
✓ Good
T3
Answer: Yes
“This Privacy Policy does not apply to information we process as a data processor or service provider on behalf of our customers.”
Policy explicitly states it acts as a data processor/service provider for customer data, indicating use is limited to providing the contracted service.
Q4Does the vendor use school or staff data for marketing, profiling or product analytics beyond operating the service?
✗ Concern
T3
Answer: Yes
“We use the Personal Information we collect from Product Interactions to deliver our Products (e.g. to receive, process, confirm, send and track your Product orders, test, develop and improve our Products, administer your Command account), and for other purposes, such as to: ... better understand how users access and use our Products to improve their performance, customize your experience, and develop new Products, features and functionality”
Policy states use of customer data for product analytics and development beyond operating the service.
Data Sharing
Q5Does the vendor limit sharing with third parties to the purpose for which the data was collected? GATE
✓ Good
T3
Answer: Yes
“We may disclose your Personal Information to: vendors that provide Verkada services, such as to: help administer and improve the Site or provide our Products ... third-party business partners, including resellers, who may co-sponsor or co-host events or conferences, conduct product demonstrations, and/or sell Verkada's Products ... third-party marketing partners who may provide you, on our behalf, with information relating to our Products or services”
Policy permits sharing with third-party business partners and marketing partners for their own purposes, not limited to service provision.
Q6Does the vendor publish or offer a list of sub-processors, naming its cloud host, and commit to notice before adding one?
? Not addressed
T3
Answer: Unclear
“We entrust the processing of certain Personal Information to vendors who process your information and under contractual obligations such as: Amazon Web Services, Inc. (U.S., AUS, and EU) – cloud hosting, data storage, and infrastructure management ... Intercom (U.S.) – manage support tickets and customer service communications ... Google Analytics (U.S.) – monitor website performance and usage”
Policy names AWS as cloud host and lists some sub-processors, but does not commit to notice before adding new sub-processors. List is provided but commitment to notify before adding is absent.
Data Sold
Q7Is staff or school personal information ever sold or rented to any outside party? GATE
? Not addressed
T3
Answer: Unclear
“We may use third-party analytics services and online advertising services that may result in the "sharing" of online identifiers and other identifiers (e.g., cookie data, IP addresses, device identifiers, general location information, usage information, email addresses) with analytics partners to help us analyze and understand use of the Site and our Products and to advertise the Products on other websites. In some cases, such practice may also constitute a "sale" of personal information under the CCPA.”
Policy acknowledges that sharing with analytics and advertising partners may constitute 'sale' or 'sharing' under CCPA, but does not clearly state whether personal information is sold or rented to outside parties in general terms.
Data Rights
Q8Does the vendor support access, correction and deletion requests from the school, with a stated process or response time?
✓ Good
T3
Answer: Yes
“Access: You have the right to ask us for copies of your Personal Information. There are some exemptions, which means you may not always receive all the information we process. If you use Command, you can access your Personal Information through your Command account. ... Erasure: You have the right to ask us to erase your Personal Information in certain circumstances. You can access, amend, or delete your information, including Personal Information, through your Command account. Please contact Verkada Support at [email protected] if you have questions regarding how to delete your account or information associated with it.”
Policy describes access, correction and deletion rights with contact method and self-service route through Command account. No specific response time stated.
Q9Does the school keep ownership of its data, with return or deletion at the end of the contract?
? Not addressed
T0
Answer: Unclear
Policy does not address whether the school/customer owns its data or whether data is returned or deleted at the end of the contract.
Retention
Q10Does the vendor state a retention period for staff data after the service ends, and whether deletion is automatic?
? Not addressed
T3
Answer: Unclear
“We retain Personal Information we collect from you for the time necessary for the purposes for which it is processed, including where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested) or to comply with applicable legal, tax or accounting requirements or as otherwise required by applicable laws and regulations.”
Policy states retention is 'as long as necessary' but does not specify a concrete retention period or deletion rule after service termination.
Data Security
Q11Does the vendor disclose baseline safeguards: encryption in transit and at rest, single sign-on with MFA for admin roles, and an independent attestation (SOC 2, ISO 27001) or equivalent?
✓ Good
T3
Answer: Yes
“All communication with Verkada's products and systems over public networks uses TLS 1.2 or greater with modern cipher suite configurations. ... Verkada completes annual SOC 2 Type 2 examinations for the Security Trust Service Criteria. ... Verkada's Command Platform has received certification for ISO 27001:2022 (information security management systems).”
Policy names encryption in transit (TLS 1.2+) and independent attestations (SOC 2 Type II, ISO 27001). Does not explicitly name encryption at rest or MFA for admin roles, but SOC 2 Type II scope may cover these.
Breach Notice
Q12Does the vendor commit to notify the customer of a security incident without undue delay, with a stated hour count?
? Not addressed
T0
Answer: Unclear
Policy does not commit to notifying customers of security incidents without undue delay or within a stated time frame.
Biometrics & Surveillance
Q13For products that capture faces, fingerprints or other biometric identifiers: does the vendor require written notice and consent before collection, and publish a retention and destruction schedule? GATE
? Not addressed
T3
Answer: Unclear
“Where permitted by applicable law (and subject to any notice or consent requirements), we may also process biometric information for access control or demonstration purposes, such as when using products like Face Pass or Face Unlock.”
Policy mentions biometric collection is subject to 'notice or consent requirements' but does not explicitly require written notice and consent before collection, nor does it publish a retention and destruction schedule for biometric data.
Q14Does the vendor use customer video, images or biometric data for its own analytics or model training?
? Not addressed
T0
Answer: Unclear
Policy does not disclose whether customer video, images or biometric data are used for vendor's own analytics or model training.
Payments
Q15For products that take card payments: does the vendor state PCI DSS compliance and name the scope it covers for the customer?
— N/A
T0
Answer: N/A
not applicable to this product type
AI & Model-Training
Q16Does the vendor use customer or staff data, including uploaded documents, to train or improve AI or machine-learning models? GATE
? Not addressed
T0
Answer: Unclear
Policy does not disclose whether customer or staff data, including uploaded documents, are used to train or improve AI or machine-learning models.
Q17Does the vendor disclose automated decisions that affect staff (screening, scheduling, pay, access) and offer human review?
? Not addressed
T0
Answer: Unclear
Policy does not disclose automated decisions that affect staff (screening, scheduling, pay, access) or offer human review.
Jurisdiction & Residency
Q18Does the vendor disclose where data is stored and which privacy laws it complies with?
✓ Good
T3
Answer: Yes
“Customer data is stored in Verkada's cloud infrastructure that uses AWS S3 or Backblaze, which are designed to provide durability of at least 99.999999999%. ... You choose exactly where your cloud data is stored (US, Canada, Australia, Germany, Japan, Singapore and South Korea) to meet local compliance requirements. ... GDPR: With respect to our customers' personal data processed by Verkada products, Verkada acts as a data processor. ... U.S. State Privacy Laws: Verkada designs its privacy practices in order to meet the evolving standards established by comprehensive state-specific privacy laws promulgated in the U.S.”
Policy discloses storage locations (US, Canada, Australia, Germany, Japan, Singapore, South Korea) and names privacy regimes (GDPR, U.S. State Privacy Laws, HIPAA, Data Privacy Framework).
Contract & Assurance
Q19Does the vendor offer a data-processing agreement or equivalent written terms to customers?
✓ Good
T3
Answer: Yes
“This infrastructure is backed by robust data processing terms in our Customer Data Processing Addendum, Standard Contractual Clauses (SCCs) designed to meet high global standards, and certification to the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework”
Policy states that a Customer Data Processing Addendum and Standard Contractual Clauses are available.
Jurisdiction & residency — your footprint
Vendor named 0 of 4 countries in your footprint. Shown alongside the verdict, not folded into the score —
a vendor can be strong on privacy yet leave residency gaps for specific countries.
“You choose exactly where your cloud data is stored (US, Canada, Australia, Germany, Japan, Singapore and South Korea) to meet local compliance requirements. ... GDPR: With respect to our customers' personal data processed by Verkada products, Verkada acts as a data processor. ... Verkada has certified to the Department of Commerce that we adhere to the Principles of the Data Privacy Frameworks”
| Country | Privacy law | Coverage |
|---|
| United States (federal) | FERPA / COPPA / PPRA | ⚠ Gap |
| Illinois | SOPPA | ⚠ Gap |
| Texas | Texas Education Code ch. 32 (student data privacy) | ⚠ Gap |
| California | SOPIPA / CCPA | ⚠ Gap |
| GDPR (overlay) | Applies when a school holds data on EU or UK students, families or staff | ✓ Named |