Terms of Service

These Terms of Service (“Terms”) are an agreement between you and Valty, Inc., a Delaware corporation (“Valty,” “we,” “us”). They apply when you visit valty.ai, request access, become a design partner, or use the Valty platform.

By accessing the site or using the service, you accept these Terms. If you are accepting for an organization, you represent that you have authority to bind that organization. A signed order form, design-partner agreement, or data processing agreement controls if it conflicts with these Terms.

Valty provides a B2B software platform that ingests customer security evidence (controls, findings, cloud signals, supplier records, and financial context), normalizes it into a traceable evidence model, quantifies associated business risk, and produces proof artifacts including board packs, audit packs, and exportable evidence packages.

Valty is a decision-support and proof-production layer. Customers own and operate their scanners, GRC systems, cloud security platforms, identity providers, and other enforcement and detection systems, and keep them as the systems of record. Valty reads and builds on that evidence, and may perform its own outside-in assessment where authorized.

Financial risk estimates produced by Valty are model-based decision-support outputs. They are not actuarial determinations, insurance products, investment advice, or legal opinions. Every estimate carries method, confidence level, and source caveat adjacent to the number. Valty is in a capacity-capped design-partner stage and is not a generally available full-platform product.

Access is invitation- or application-based. A design-partner sprint covers one company at a time unless an order form says otherwise. We may accept, wait-list, or decline applications. Preview features, illustrative examples, and marketing screenshots are not customer outcomes and are not a warranty of future results.

You are responsible for the accounts you authorize, for keeping credentials confidential, and for activity under those accounts. Notify us promptly at security@valty.ai if you believe an account is compromised.

Customers may use Valty to:

• Ingest and normalize their own security evidence from authorized source systems.
• Produce risk quantification, proof packs, and evidence artifacts for internal governance, audit, board reporting, insurance, and investor diligence purposes.
• Enable authorized users within their organization and their authorized advisors to access the platform.

Customers may not:

• Use the platform to process personal data of third parties without lawful basis or in violation of applicable privacy law.
• Attempt to gain unauthorized access to other customers' workspaces, data, or Valty infrastructure.
• Use automated means to scrape, extract, or replicate Valty platform functionality outside of documented API access.
• Present Valty decision-support estimates as binding financial, legal, or actuarial conclusions without appropriate qualification.
• Resell or sublicense platform access without a written agreement.
• Introduce malicious code, conduct penetration testing against Valty infrastructure without authorization, or interfere with platform availability.

All security evidence, findings, controls, financial context, and other data that customers upload or connect through Valty source adapters remains the property of the customer. Valty receives a limited license to process that data solely to deliver the contracted service.

Valty does not transfer or disclose customer data to third parties except to subprocessors required to deliver the service, as required by law, or as explicitly authorized by the customer in writing.

Upon termination of a customer agreement, Valty will make customer data available for export for a reasonable period, then delete or anonymize it in accordance with the applicable data processing agreement and retention policy.

Valty will not use customer security evidence to train or improve machine-learning models without explicit, separately documented customer consent.

Each party agrees to hold the other's confidential information in confidence using at least the same degree of care it uses to protect its own confidential information, but not less than reasonable care. Confidential information includes non-public business plans, product roadmaps, customer data, pricing, technical specifications, and security posture.

Confidentiality obligations do not apply to information that: (a) is or becomes publicly known through no breach of this agreement; (b) was already known to the receiving party without restriction; (c) is independently developed by the receiving party without use of confidential information; or (d) is required to be disclosed by law, regulation, or court order, provided the disclosing party is given reasonable prior notice where permitted.

Valty handles customer security evidence, which frequently includes material non-public risk information, with particular care. Workspace access is role-scoped and audit-logged.

Valty warrants that it will provide the service with reasonable skill and care and in material conformance with applicable documentation during the subscription or design-partner term.

Disclaimer: Except as expressly stated above, the Valty platform is provided “as is” and “as available” without warranty of any kind, express or implied, including implied warranties of merchantability, fitness for a particular purpose, and non-infringement. Valty does not warrant that the service will be uninterrupted or error-free.

Financial risk estimates and EBITDA-impacting loss-exposure ranges produced by Valty are decision-support outputs based on methods, assumptions, and source coverage visible in the platform. They are not actuarial determinations, investment advice, valuations, or representations of future performance. Customers must apply their own judgment before using estimates in regulated, contractual, or public contexts.

To the fullest extent permitted by law, neither party will be liable to the other for indirect, incidental, special, consequential, or punitive damages arising from or related to the service, even if advised of the possibility of such damages.

Each party's aggregate liability for direct damages arising from or related to the service in any twelve-month period will not exceed the greater of (a) the total fees paid or payable by the customer to Valty during that period or (b) one thousand U.S. dollars if no fees were paid. A signed order form may set a different cap.

These limitations do not apply to: (a) a party's indemnification obligations; (b) damages resulting from gross negligence or willful misconduct; (c) a party's breach of confidentiality obligations; (d) a customer's breach of acceptable use; or (e) amounts owed for services rendered.

The terms of service are effective from the date a customer accepts them (by clicking to accept, signing an order form, or otherwise using the service) and continue for the subscription term stated in the applicable order or agreement.

Either party may terminate the agreement:

• For cause if the other party materially breaches the agreement and fails to cure within 30 days of written notice.
• Immediately if the other party becomes insolvent, makes an assignment for the benefit of creditors, or enters bankruptcy proceedings.

Upon termination, the customer's right to access the platform ceases. Valty will make customer data available for export for 30 days following termination, after which it will be deleted in accordance with the retention policy. Fees paid prior to termination are non-refundable except where required by law or agreed in writing.

Sections governing customer data ownership, confidentiality, limitation of liability, warranties and disclaimers, and governing law survive termination.

These Terms are governed by the laws of the State of Delaware, excluding its conflict-of-law rules, unless a signed order form names a different governing law. Exclusive venue is the state and federal courts located in New Castle County, Delaware, except that either party may seek injunctive relief in any court of competent jurisdiction.

The United Nations Convention on Contracts for the International Sale of Goods does not apply.

We may update these Terms as the service or the law changes. The effective date at the top of this page is the version in force. Material changes will be posted here and, for customers with an active agreement, sent to the notice email on file. Continued use after the effective date of a posted change is acceptance of the updated Terms, except that a signed order form still controls if it conflicts.