Pricing follows proof.

Every financial output Valty produces carries four fields visible at the point of use: method, confidence band (P10 / base / P90), source coverage, and freshness date. The number is not decorative. It is a decision-support estimate built on a FAIR-aligned Monte Carlo model that shows its assumptions rather than burying them in a disclaimer.

What “defensible” means in practice: the EBITDA bridge shows which control gaps drive the exposure, what probability and magnitude assumptions underlie each scenario, and what the evidence coverage is for each assumption. A CFO or board reviewer can challenge any individual driver directly, rather than needing to accept or reject a headline figure on faith.

The model does not claim precision it cannot earn. Outputs are labeled decision-support estimates. When source coverage is thin, Valty labels the evidence gap and can block the claim from publication rather than silently publishing it. V1 does not automatically rewrite FAIR input ranges solely because source coverage is thin.

Valty works from available evidence. It does not require a new scanner, agent install, or privileged shell access to your production environment. The typical starting point is read access to the evidence sources you already operate: a scanner export, a GRC control export, a cloud security posture signal, or an identity and findings feed.

The platform ingests, normalizes, and enriches what is already there, and sits above your systems as a translation layer. Getting started does not require replacing them. Source adapters are scoped by the customer; data flows into Valty on the terms you define, not ours.

In the design-partner stage, the integration is co-designed with your team. We map which evidence sources cover which control domains, agree on freshness thresholds and owner assignments, and scope the connector surface to exactly what the proof motion needs, and nothing more.

Security ratings (BitSight, SecurityScorecard, etc.) score your external attack surface from the outside. They are fast and comparative, but they do not see your control verification state, your internal finding remediation status, or what the exposure means for EBITDA.

GRC platforms (ServiceNow, Archer, Tugboat Logic, etc.) track control frameworks, policy compliance, and audit workflows. They are the authoritative control register. What they rarely do is translate verified control gaps into a financial impact estimate a CFO or board can act on, or rank remediation priorities by ROI rather than framework weight.

Valty is a translation layer, not a competitor to either. It reads from your GRC and your scanner, maps control gaps to financial exposure scenarios using a FAIR-aligned model, ranks remediation by expected EBITDA impact per dollar spent, and packages the result as a board-ready proof artifact with source, confidence, and freshness visible. The GRC is still the control record. The rating is still the external signal. Valty is the business-impact layer above both.

Your source-of-truth systems stay yours. Valty does not become the record system for your controls, findings, cloud posture, identity state, or financial model. Those remain in the systems you already operate.

Valty normalizes evidence from those systems into a proof object, a structured artifact that links the claim, the source, the confidence, the freshness, and the publication state. That proof object is tenant-isolated within your Valty workspace. No cross-tenant evidence exposure. No shared inference across accounts.

Data residency, retention periods, and subprocessor scope are addressed in the vendor security questionnaire and NDA, which are part of every design-partner onboarding. We do not publish detailed subprocessor lists without a reviewed trust-center artifact behind them. Contact security@valty.ai for the current security posture package.

Valty has an active confidential design partnership, but does not publish the partner's identity or engagement specifics. We do not turn confidentiality into implied payment status, customer-authorized production scope, source authorization, or customer outcomes.

The current proof ladder is explicit. Valty-on-Valty dogfooding is real internal production evidence for the control, evidence, and governance workflows. The active design partnership adds external validation. The authenticated seeded demonstration shows the product path safely, but is not production or customer-outcome proof.

What buyers can evaluate directly is the deployed product, published methodology, inspectable proof model, and stage-labeled scenario library. Paid/customer outcomes, portability, and willingness to pay require separate evidence and are not represented here.

Stage-honest positioning is a constraint we enforce technically: the product’s claim-gate blocks unsupported assertions from being published in proof packs. We apply the same discipline to our own marketing copy.