VERA
VERA is the AI built into ENSURE, a Swiss QHSE platform for industrial SMEs. It runs hazard analysis, guided root-cause investigations, photo risk assessments and SDS or ISO clause extraction, citing your own procedures on every answer.
What is VERA?
VERA is the artificial-intelligence layer built into ENSURE, a Swiss QHSE platform covering quality, health, safety and environment for industrial companies of roughly 20 to 500 people. The publisher is emphatic that VERA is not a bolt-on chatbot: it appears inside the screens where the work already happens, in an incident investigation, a job hazard analysis, a chemical register or a legal register, rather than in a separate chat window. ENSURE counts eighteen connected modules, and VERA runs across them. Six capabilities are documented. Ask VERA answers plain-language questions about the organisation's own procedures, safety data sheets, regulatory clauses and records. A root-cause facilitator walks an investigator through a structured 5 Whys or Fishbone on an incident or a non-conformance, saving the full transcript to the record. A photo risk assessment turns a picture of a work area into a documented last-minute risk assessment, listing visible hazards, proposing a severity and likelihood, and suggesting controls down the hierarchy. A job hazard analysis capability takes a task described in ordinary words and returns hazards by category, mechanical, chemical or ergonomic, scored before and after controls. A legal clause extractor ingests an ISO, OSHA or EU regulation PDF and returns every numbered clause with its requirement text, preserving the document's own numbering: ISO 45001 yields 65 clauses, ISO 14001 sixty, and a construction code of practice can reach two hundred. An SDS extractor reads a safety data sheet and pre-fills product name, CAS number, GHS pictograms, hazard statements, required PPE, storage and spill response. Two constraints define the product more than the model behind it. The first is grounding: answers come only from the customer organisation's own uploaded documents, never the public internet, and the system is tenant-isolated and permission-aware, so a user sees citations only from documents they are cleared to read. The second is citation: every answer carries the SOP, clause or record it came from, openable in one click. The human stays in the loop by design. The facilitator asks one question at a time and never auto-fills an answer, and suggested hazards must be accepted or edited before entering an analysis. Behind the scenes the features run on third-party APIs: Anthropic for hazard analysis and SDS extraction, OpenAI for embeddings, conversational search and clause extraction. VERA is not sold on its own; it is included with every Full seat.
What it does
- Answer plain-language questions about your own SOPs, safety data sheets, regulatory clauses and records, with a clickable citation on every answer
- Facilitate a guided 5 Whys or Fishbone root-cause investigation on an incident or a non-conformance, one question at a time
- Suggest hazards and controls for a task described in plain words, scored before and after controls, each control citing the procedure it comes from
- Read a photo of a work area and return the visible hazards, a suggested severity and likelihood, and controls down the hierarchy
- Extract every numbered clause from an ISO, OSHA or EU regulation PDF, preserving the source numbering and requirement text
- Extract a safety data sheet into structured GHS data: product name, CAS number, pictograms, hazard statements, PPE, storage and spill response
- Feed extracted chemicals into the emergency plan's spill scenario and its exported PDF
When to use VERA / When not to
A quick filter to help you decide if VERA is the right fit.
When to use VERA
- The lone HSE or quality manager in an industrial company of 20 to 500 people, with no dedicated team to administer a software platform
- Organisations already certified to, or working towards, ISO 9001, ISO 45001 or ISO 14001, who need per-clause evidence ready before audit week
- Teams coming off a patchwork of Excel workbooks, SharePoint folders and email threads who cannot justify a six-figure enterprise contract
- Safety-critical operations in manufacturing, construction, warehousing, food and beverage, facilities management, healthcare and oil and gas
- Multilingual sites where an operator writes in one language and the governing procedure is filed in another
When not to use VERA
- Heavy-process operators who need process-safety modelling such as PHAST or FLACS, or full product-stewardship tooling for globally regulated chemical portfolios; the publisher states plainly that it does not compete there
- Organisations above roughly 5,000 employees, or any IT department requiring an on-premise deployment, since the platform is multi-tenant SaaS only
- Companies that want the whole workforce to use the AI: VERA is a Full-seat capability and is switched off on the lower-cost User seat
- Buyers who need a published rate card to build a budget, or a permanent free tier rather than a time-limited trial
- Teams that need to wire the tool into an existing stack: there is no product API, no native mobile app and no third-party integration available today
How to use VERA
A typical end-to-end flow, from setup to results.
- Start a 14-day free trial from the sign-up page, or book a 30-minute demo call with the founder instead
- Configure the organisation: add sites, departments, users and roles, a step the publisher designs to take under an hour
- Import an existing risk register from Excel if you already keep one
- Decide who gets a Full seat and who gets a User seat, since VERA only runs on Full seats
- Upload your controlled documents, SOPs and work instructions so the AI has something to ground its answers in
- Drop an ISO, OSHA or EU regulation PDF into the legal register to have every clause extracted and given a compliance status
- Drop safety data sheets into the chemical register to pre-fill GHS data, PPE, storage and spill response
- Describe a job task in the hazard analysis screen and accept or edit each hazard the AI suggests before it lands in the analysis
- On the floor, photograph a work area from your phone to produce a documented last-minute risk assessment, offline if needed
- Ask VERA questions in plain language whenever you need a procedure, a clause or a figure, and open the cited source in one click
Pros & Cons
Pros
- Every answer is cited and the citation is clickable, opening the exact SOP, clause or record it came from
- Answers are grounded in the organisation's own documents and never the public internet, which rules out generic safety boilerplate
- The human keeps control: the facilitator never auto-fills an answer, and suggested hazards must be accepted or edited before publication
- Tenant isolation and permission-awareness mean a user only ever sees citations from documents they are cleared to read
- Unusual candour from the publisher, which publishes its six sub-processors with their data regions, admits holding neither SOC 2 nor ISO 27001, and names the cases where a competitor is the better choice
- Every AI capability is included on the Full seat with no separate AI tier and no per-module upsell, and full data export is available at any time on every plan
- Genuinely multilingual: seven interface languages, and document extraction that preserves the source language of the file
Cons
- No price is published at all: no amount, no currency, no rate card and no bracket, so a budget cannot be built without a sales call
- No permanent free plan, only a 14-day trial that asks for payment details at signup
- VERA is excluded from the User seat, so most of a field workforce will not have access to the AI
- A very small and very young publisher: a Swiss sole proprietorship with a single owner, not entered in the Handelsregister and not VAT-registered, with incorporation as a GmbH only announced
- No security certification whatsoever, neither SOC 2 nor ISO 27001, both described by the publisher as roadmap items, and no public customer reference or testimonial
- No product API and no API documentation, no third-party integration available, no native mobile app, and single sign-on shown as coming soon
- The EU-hosted message covers storage in Ireland, while the AI processing that powers VERA runs through Anthropic and OpenAI in the United States
Pricing & Plans
ENSURE publishes no price for VERA or for the platform that carries it. There is no permanent free plan: every Standard subscription opens with a 14-day free trial, payment details are collected at signup, and billing begins only once the trial ends, with cancellation possible beforehand at no cost. Licensing is per seat, billed monthly on Standard and annually on Enterprise. VERA is included on every Full seat at no additional charge, while the lower-cost User seat has no access to the AI. All modules are included on both offers and on both seat types, administration rights are a flag on a Full seat rather than a separate charge, and neither offer carries a setup fee. Because no amount, currency or unit rate appears anywhere on the site, no lowest price point can be stated. The publisher explains the choice on its pricing page, arguing that the figure depends on the seat mix, the number of sites and countries, and the level of onboarding required, and undertakes to return a quote within 24 hours.
Data, GDPR & hosting
A consolidated view of how VERA handles your data.
GDPR overview
GDPR implementation is concrete and unusually well documented for a publisher this small. The privacy policy, effective 17 May 2026, carries a dedicated Legal basis (GDPR) section naming contract performance, legitimate interests, legal obligation and consent. Data subject rights are enumerated (access, rectification, export, restriction, erasure, objection), exercised through privacy@ensureqhse.com, with the right to complain to a local supervisory authority. Six sub-processors are published with their data region, and customers get 30 days' written notice before one is added or replaced. Transfers outside the EEA are covered by Standard Contractual Clauses, and an Article 28 Data Processing Agreement is available on request. Two gaps are worth naming: the publisher is established in Switzerland, outside the EU, yet designates no Article 27 representative anywhere on the site, and no Data Protection Officer is named.
Who owns the data?
The customer keeps every right to the data it and its users upload, which the terms call Customer Data. The publisher receives only a limited licence to host, process and display that data for the sole purpose of operating the service for that customer. Nothing in the terms grants a broader reuse. Data is tenant-isolated with row-level security in the database and a least-privilege access model, so answers are drawn only from the customer's own records and never from another customer's. Full export is available at any time on every plan, covering every table, attachment and audit log in standard formats, and old document versions stay searchable for audit purposes.
Reuse rights
The customer may reuse its own data freely and without asking permission: it retains all rights to it, and the publisher only holds a limited operating licence. Export is offered at any time on every plan, in standard formats, and the publisher explicitly rejects vendor lock-in and any contact-us-to-export friction. Every register can be exported to Excel and PDF together with the full audit trail, and after termination a 30-day window stays open to retrieve everything. On the publisher's side, use is restricted to delivering the service, authenticating users, securing the platform, communicating about the account and meeting legal obligations. The privacy policy states that data is not sold and that operational data is not used to train AI models. The AI features are served through Anthropic and OpenAI on API tiers where, according to the publisher, submitted data is not used for model training by default.
Data retention & training
Hosting summary
The publisher publishes a full sub-processor table with the data region of each one. The database, authentication, file storage and edge functions run on Supabase in the EU, specifically the Irish eu-west-1 region. Web hosting and the CDN run on Vercel across a global edge with the EU as primary region, DNS resolution and domain registration go through Cloudflare's global anycast network, and transactional email is handled by Resend in the EU. The AI features themselves are the exception: Anthropic serves hazard analysis and SDS extraction, and OpenAI serves embeddings, conversational search and legal clause extraction, both from the United States. The stated principle is to select EU regions wherever possible to keep data within the EEA, with any transfer outside the EEA covered by Standard Contractual Clauses. EU data residency is the default, with row-level isolation per organisation in the database, encryption at rest and TLS in transit. Customers receive 30 days' written notice before a sub-processor with access to customer data is added or replaced.
Things to keep in mind
Risks and trade-offs to weigh before adopting VERA.
- Cited answers feel authoritative, and that is exactly the risk: a clause extracted from a PDF or a hazard suggested from a photo still needs a competent human to verify it before it becomes a control someone's safety depends on
- Convenience can erode the skill it replaces; an investigator who leans on the facilitator for every 5 Whys may stop building the instinct to frame the right question unaided
- The publisher is a single named individual operating a sole proprietorship that is not entered in the Handelsregister and not VAT-registered: business continuity rests on one person, and incorporation as a GmbH is only announced
- No security certification exists, neither SOC 2 nor ISO 27001, so a demanding procurement or IT review is likely to block the purchase
- The publisher is established in Switzerland, outside the EU, yet designates no GDPR Article 27 representative and names no Data Protection Officer
- The EU-hosted claim refers to storage in Ireland, while VERA's own processing passes through providers in the United States; the non-training commitment for those providers is worded as a default, with no opt-out the customer can switch on
- Every ISO, OSHA, REACH, GHS and CSRD reference on the site describes what the software helps you manage, not a certification the publisher holds; do not read the standards on those pages as vendor credentials
Setup & Integrations
Technical difficulty
Low. This is a web application with nothing to install or deploy, and signup is self-service with same-day go-live claimed on the Standard offer. Initial configuration covers sites, departments, users and roles, plus an optional import of an existing Excel risk register, and is designed to take under an hour. The product is deliberately opinionated, with a fixed 5x5 matrix and a fixed CAPA process, which reduces configuration work. Using VERA itself needs no technical skill: upload a PDF, take a photo, describe a task. The one friction point is the absence of single sign-on, still shown as coming soon, so accounts are managed by hand.
Deployment
Supported languages
Behind VERA
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement VERA.
Frequently asked questions
Is VERA a separate product I can buy on its own?
Where do VERA's answers come from?
Does VERA fill in the analysis for me?
What kinds of documents can VERA read?
Which languages are supported?
How much does it cost?
Is my data used to train AI models?
Where is my data hosted?
Is there an API?
What happens to our data if we leave?
Should you pick VERA?
VERA is a rare example of a business AI that is genuinely constrained rather than merely capable. It answers only from the customer's own documents, cites its source on every reply, refuses to auto-fill an investigator's answers, and stays inside tenant and permission boundaries. For a QHSE lead whose real problem is proving a clause, finding the current SOP or documenting a hazard trail before an audit, those constraints are the product. The bet the publisher makes is depth of integration into safety workflows rather than raw model power, and on the evidence of the site that bet is well executed: hazard analysis, root-cause facilitation, photo risk assessment, regulatory clause extraction and safety data sheet extraction all land inside the screen where the work is already being done, and feed the same audit trail. The counterweight is the publisher itself. This is a one-person Swiss sole proprietorship, not entered in the commercial register and not VAT-registered, with incorporation as a limited company only planned. It holds no security certification, publishes no customer reference, offers no product API and no integrations, and shows no price at all. Any procurement or IT function with a standard vendor checklist will stall on several of those points at once. What partly offsets the risk is candour. The publisher lists its six sub-processors with their data regions, states outright that it holds neither SOC 2 nor ISO 27001, names the situations where a larger competitor is the better choice, and guarantees full data export on every plan. That is more transparency than most vendors of any size offer. VERA suits the industrial SME of 20 to 500 people already committed to ISO 9001, 45001 or 14001 and currently running on spreadsheets, provided it can accept a young supplier and a quote-only conversation.
- Choosing a selection results in a full page refresh.
- Opens in a new window.