DV-T0 · Trust
This page reads like your own vendor checklist. That is deliberate.
Everything your procurement, DPO and outsourcing officer will ask, answered in the order they ask it. Every document referenced here is available on request from ariella@domaveri.com.
01 — Data protection (GDPR)
- Roles
- For portfolio verification services Domaveri acts as processor under Article 28 GDPR; your institution is the controller. For imagery and signals we source independently, we act as controller with a documented lawful basis.
- Lawful basis
- Verification of premises relies on legitimate interest (Art. 6(1)(f)) — the lender’s interest in protecting collateral and meeting supervisory obligations — supported by a documented balancing test.
- Premises, not persons
- The service verifies the status of property. Faces and license plates are irreversibly blurred at ingestion. We do not build profiles of individuals, and we do not sell data.
- Data minimization
- We collect only what the verdict requires, retain evidence only for the contracted retention period, and return or delete on exit.
- Your rights machinery
- DPA (Art. 28) with SCCs where applicable, Records of Processing (Art. 30), DPIA summary, and a named privacy contact.
02 — Data residency
- Customer portfolio data and evidence packs are processed and stored in the European Union.
- Sub-processors with EU data centers are the default; any transfer outside the EEA is governed by Standard Contractual Clauses and listed in the sub-processor register.
- The current sub-processor list, with the residency of each, is supplied with the vendor file and updated with 30 days’ notice of changes.
03 — DORA & outsourcing
Written for your outsourcing register, not for our marketing.
- Classification
- For most institutions Domaveri is an ICT third-party service provider supporting a non-critical function; we supply the completed Register of Information entry in the ESA template format.
- Contract terms
- DORA-aligned provisions: audit and access rights for you and your competent authority, incident notification timelines, sub-outsourcing transparency, and defined service levels.
- Exit plan
- A documented exit and data-return plan is part of the standard contract — evidence packs are yours, in open formats, from day one. No lock-in by format.
- Concentration risk
- Evidence layers are multi-sourced by design; no single imagery or data supplier is a single point of failure.
04 — Security
- Encryption in transit (TLS 1.2+) and at rest (AES-256).
- Role-based access on a need-to-know basis; MFA enforced for all staff and contractor accounts.
- Vetted field operators under written agreements covering confidentiality, data handling and conduct.
- Logging and traceability on every evidence item: capture time, source, coordinates, operator, reference number.
- Security overview and incident-response summary included in the vendor file. Certification roadmap available on request.
05 — Insurance
- Professional indemnity insurance in force; certificate supplied with the vendor file.
- Coverage details, limits and insurer available under NDA.
06 — How to test us without trusting us
You should not have to take a verification company’s word for anything, least of all ours. The pilot is built to be failed.
- You choose the ten addresses. Include some you already know the answer to — recently inspected, recently recovered, recently sold. Do not tell us which ones.
- We return ten signed verdicts within 72 hours, each with its evidence, coordinates and capture date.
- Score us against what you already knew. A verification service that cannot survive a blind sample is not worth buying.
- Nothing in the pilot depends on our goodwill: the evidence pack is yours to keep, and yours to show to anyone you like.
07 — When we are wrong
A measurement business that claims never to be wrong is describing a marketing position, not a method.
- Amber exists so that uncertainty is reported rather than absorbed into a green. We would rather show you a gap than a guess.
- Every verdict is challengeable on its evidence. Each carries the capture date, coordinates, operator reference and imagery, so a challenge is an examination of evidence rather than an argument between opinions.
- Where a verdict is overturned, the correction and its cause are recorded against the portfolio rather than quietly replaced.
- Professional indemnity insurance is in force; certificate, limits and insurer are in the vendor file and available under NDA.
08 — If we cease to exist
The fair question to ask any young supplier, and one better asked before you need the answer than after.
- Evidence packs are yours from day one, in open formats — documents and structured data, not a proprietary viewer.
- Nothing you rely on lives only inside our product. A verdict and its evidence stay readable with no software of ours running.
- The exit and data-return plan is part of the standard contract, not a concession negotiated later.
- Evidence layers are multi-sourced by design, so no single supplier of ours becomes a single point of failure for you.
09 — The vendor file
One request, one pack.
- Data Processing Agreement (Art. 28) + SCCs where applicable
- Sub-processor list with data residency map
- DORA outsourcing information pack, including the Register of Information entry
- Security overview + access policy
- Certificate of insurance
- Exit & data return plan