VERUS
Get started

Connecting VERUS

The IT checklist

Exactly what your IT team does to connect VERUS, and what we do. One machine, a read-only login per system, a certificate and two firewall rules. We estimate a few hours of your team’s time in all, spread over a week. VERUS has not yet been installed at a company, so these times are our estimates; the install itself is measured.

How VERUS stays secure
VERUS the architect: connects and maps your systems
  1. 1

    A machine for VERUS

    Your IT teamabout an hour
    • A Linux virtual machine on your own servers or in your own cloud account: 4 CPUs, 16 GB of memory.
    • Disk: 50 GB for VERUS, plus about twice the size of the data you connect. Encrypted, and in your backups.
    • Docker Engine with the Compose plugin.
    • Windows Server with Docker works too; a Linux virtual machine is what most IT teams prefer.
  2. 2

    The network

    Your IT teamabout half an hour
    • Inbound: https (port 443) to the VERUS machine from your own users' network only. Nothing from the internet.
    • From the VERUS machine to each system it reads, on that system's own port (SQL Server 1433, PostgreSQL 5432, and so on).
    • Outbound to the internet: none is required. Only if you turn them on: your AI provider, the public economic data sources, the phone notification services. The exact addresses are in the security pack.
  3. 3

    A certificate for https

    Togetherabout half an hour
    • A certificate your devices trust, from your own certificate authority or a public one, for a name such as verus.yourcompany.internal.
    • We set up the small web server in front of VERUS that uses it, with you.
  4. 4

    A read-only login for each system

    Your IT teamabout 15 minutes each
    • One login per system VERUS reads (the ERP, maintenance, quality, HR, CRM), with read access only to what VERUS should see.
    • We give you the exact script for your database. For SQL Server it is four lines (below).
    • For exported files: a read-only share or SFTP account on one folder. For web-service systems: a read-only API user.
  5. 5

    Install and connect

    VERUS teamabout 6 minutes to install, then about an hour per system
    • We install VERUS on your machine with your team watching, on a shared screen.
    • You type each read-only password into VERUS yourself; it is stored encrypted, on your machine.
    • VERUS works out each system's tables and codes, and asks your people a handful of yes-or-no questions where it is not sure.
  6. 6

    People and access

    Togetherabout half an hour
    • An administrator signs in first and adds your people, each with the companies, sites and subjects their job needs.
    • Single sign-on is not built yet: people sign in with a password, at least 12 characters.

The read-only login, for SQL Server

Most on-premises ERPs (Dynamics AX, Epicor, SYSPRO and many others) run on SQL Server. This is the whole script. We send the equivalent for PostgreSQL, MySQL, Oracle and cloud warehouses with the security pack.

CREATE LOGIN verus_ro WITH PASSWORD = '<long random password>', CHECK_POLICY = ON;
USE <database>;
CREATE USER verus_ro FOR LOGIN verus_ro;
ALTER ROLE db_datareader ADD MEMBER verus_ro;
-- Optional: keep VERUS away from tables it should never read, such as payroll.
-- DENY SELECT ON <schema>.<table> TO verus_ro;

This login can read and change nothing. VERUS adds two more locks of its own: it has no way to write, and every statement is checked to be a single plain read before it is sent.

What VERUS never needs

  • Write, change or admin rights on any system
  • A way in from the internet
  • Remote access for us: we never connect to it
  • Changes to your ERP or any other system
  • An AI model: it runs without one if you prefer

What you keep

  • The machine, the data on it, and its backups
  • Every read-only login, and the power to switch it off
  • The audit log of everything done in VERUS
  • The encryption key for the stored passwords
  • Your definitions, codes and rules, if you ever leave

Ready to hand this to IT?

We send the full security pack: the scripts for every database, the exact outbound addresses, the data handling statement and answers to your security questionnaire.

Ask for the security pack