Verification should be written in the form or in the model.

As @Woljciech said, if you can validate data before passign to model it will be the best. This way you do not hit the database layer, which in large applications could slow you down.

Basically what I do is:

1. Validate forms with javascript before sending to server;

2. Use Phalcon forms again to validate the data (since client based validation can be exploited);

3. Pass data to model to save (here you can also have validation for unique columns e.t.c.).