Valty-on-Valty production dogfood
- Source
- Valty control, evidence, and governance workflows
- Confidence
- Real internal production evidence
- Freshness
- Current internal use; does not prove customer portability
Trust center
Valty, on Valty: our own posture, in the same evidence model we sell.
Valty uses its own control, evidence, and governance workflows in production. An active confidential design partnership adds external validation; the authenticated seeded demo remains a separate demonstration path.
Contact security teamProof ladder
Three distinct proof levels, with boundaries visible.
Internal production use, external design-partner validation, and a seeded demonstration answer different questions. None is presented as paid customer-outcome proof.
Active confidential design partnership
- Source
- External product and workflow validation
- Confidence
- Active partnership; identity and specifics confidential
- Freshness
- Commercial status, environment scope, authorization, and outcomes not represented
Authenticated seeded demonstration
- Source
- Seeded data in an authenticated workspace
- Confidence
- Demonstrates the product path safely
- Freshness
- Demonstration evidence; not production or customer-outcome proof
Paid/customer outcomes, willingness to pay, and customer portability require separate evidence and are not represented on this page.
Hosted on Vercel with a Neon Postgres database and Upstash Redis; production secrets are stored in GCP Secret Manager. Tenant data is logically isolated per workspace.
TLS 1.2 minimum; TLS 1.3 negotiated on modern clients (enforced at the edge). AES-256 at rest via provider-managed keys.
Not yet achieved. Audit-readiness program is in scope for the platform-closure plan.
Public and tenant data are strictly separated
The marketing site (valty.ai) does not share infrastructure or data storage with the product application (app.valty.ai). Customer evidence, findings, and proof artifacts do not flow to or from the public surface.
Tenant isolation enforced at the database layer
Row-level security (RLS) policies on every production table enforce workspace scope. Cross-tenant reads require explicit SECURITY DEFINER functions with reviewed scope. No tenant can read another tenant's evidence.
Credentials stored in GCP Secret Manager, not environment variables
Production credentials, including API keys, database owner URLs, and OAuth client secrets, are stored in GCP Secret Manager and referenced at runtime. They are not committed to source control and not embedded in deployment configs.
Authentication via NextAuth with short-lived JWTs
Session tokens are short-lived JWTs signed server-side. MFA is available for workspace administrators. OAuth (Google SSO) is the recommended production path.
Valty evidence grammar applied to Valty
The same EvidenceTrustCard and FrameworkModeCard the product sells, displaying Valty's own posture.
Valty runs the underlying control, evidence, and governance workflows on Valty in production. That operational dogfood is real internal production evidence. Design partner on a displayed metric means the value itself is illustrative, not an audited Valty financial or a customer result.
EvidenceTrustCard + EvidenceShield
Evidence trust
T1Hardware-attestedPassFresh 18h
T2Software-attestedPassFresh 2d
T3API-verifiedReviewFresh 4d
Hash-chain verified across the export window.
FrameworkModeStack
Evidence-mode coverage
- Automated
- 62
- Assisted
- 24
- Manual
- 14
Certification status
What is achieved, what is roadmap, and what is inherited from our infrastructure providers.
Certifications that are not yet achieved are labeled Roadmap preview. We do not claim SOC 2 or FedRAMP as achieved until the audit report exists.
SOC 2 Type II
- Status
- Roadmap
- Note
- Audit-readiness program in progress. Not yet achieved. Target: platform-closure Stage 3.
FedRAMP
- Status
- Roadmap
- Note
- Future roadmap, aligned with federal/supply-chain customer motion. No authorization in progress at this stage.
ISO 27001
- Status
- Roadmap
- Note
- Under evaluation as a complement to SOC 2. No active certification engagement.
Penetration test (3rd party)
- Status
- Roadmap
- Note
- Independent pen test is in roadmap for design-partner close. Internal review completed; external assessment not yet commissioned.
Encryption at rest (AES-256)
- Status
- Via provider
- Note
- Provider-managed AES-256 on Neon Postgres and Vercel storage. Inherited from Neon / Vercel provider attestations.
GDPR / CCPA baseline
- Status
- Baseline in place
- Note
- Privacy policy and data-handling baseline in place. Formal DPA available on request. Legal-counsel review cycle.
Proof matrix
Certification and compliance posture: source, confidence, freshness
Every certification claim carries publication state, source, and freshness so buyers can assess what is audited versus what is a design intent.
ClaimSourceConfidenceFreshness
SOC 2 Type IIInternal audit-readiness programNot yet achieved. On roadmap.Status reviewed quarterly
FedRAMPPlatform-closure plan, Stage 3 targetNot yet achieved. Future roadmap.Status reviewed with federal engagement milestones
ISO 27001Under evaluationNot yet scoped. Roadmap consideration.Status TBD
Penetration testNot yet completed by independent third partyInternal review only at this stageThird-party pen test is in roadmap for design-partner close
GDPR / CCPA readinessPrivacy policy and data-processing baselineBaseline in place; formal DPA available on requestReviewed on legal-counsel cycle
Encryption at restProvider-managed AES-256 (Neon Postgres, Vercel)Platform-enforced via provider attestationInherited from Neon / Vercel provider attestations
Production dogfood: EBITDA bridge applied to Valty
Real internal workflow, clearly labeled illustrative financial inputs. Design partner
Valty runs its own control, evidence, and governance workflow in production. The bridge below demonstrates that real internal workflow while keeping its financial inputs and dollar outputs explicitly illustrative rather than presenting them as audited Valty financials or customer outcomes.
![Internal EBITDA Bridge [illustrative] product surface](/product-screenshots/04-ebitda-protection-bridge.webp)
What this demonstrates
Evidence discipline holds even when the subject is us.
- Same FAIR-style loss-exposure workflow implemented by the product
- Confidence band and P10/Base/P90 range visible inline
- Assumptions inspectable before the number is shared
- Financial output is decision-support, not a warranty or insurance basis
- Blocked claims (unresolved evidence gaps) labeled before any board delivery
The workflow is real internal production dogfood. The displayed inputs and dollar outputs are illustrative ranges, not audited Valty financials, customer outcomes, or a formal disclosure.
Architectural proof
What is reviewable at design-partner stage without an NDA.
Multi-tenant isolation
- Source
- RLS-enforced PostgreSQL (Neon). Row-level security on every tenant-scoped table
- Confidence
- Architecture-enforced; reviewed in Phase 0 RBAC audit (2026-06)
- Freshness
- Reviewed on schema change; SECURITY DEFINER functions audited per PR
Credential storage
- Source
- GCP Secret Manager. No credentials in source control or deployment configs
- Confidence
- Operational fact; GCP access log available to design-partner reviewers under NDA
- Freshness
- Secret rotation reviewed quarterly or on personnel change
Data residency
- Source
- Vercel US region + Neon US cluster + Upstash US; GCP Secret Manager (US)
- Confidence
- Infrastructure fact, configurable per enterprise engagement
- Freshness
- Reviewed when tenant data-residency requirements are scoped
Authentication
- Source
- NextAuth JWTs + Google OAuth SSO. Session scope enforced server-side
- Confidence
- Production-verified; admin bypass requires explicit per-PR consent
- Freshness
- Auth posture reviewed on library update cycle and on security inquiry
Encryption in transit
- Source
- TLS 1.2 minimum; TLS 1.3 negotiated on modern clients (enforced at the edge). No HTTP in production.
- Confidence
- Infrastructure-enforced at the edge; inherited from Vercel TLS attestation
- Freshness
- Reviewed on edge config change
Audit logging
- Source
- Application-layer event log + GCP Cloud Audit Logs for secret-management actions
- Confidence
- Operational; completeness reviewed before SOC 2 audit scope is finalized
- Freshness
- Log retention follows GCP default (400-day) + application-level archival
Subprocessors
Third-party services that process Valty customer or lead data.
This list is current as of the trust-center publication date. Changes are made when a subprocessor is added, removed, or changes scope. Enterprise customers may request advance notice of material subprocessor changes via security@valty.ai.
SubprocessorRoleScopeRegionCertification
VercelApplication hosting and CDNProduct + siteUSA + global edgeSOC 2 Type II
NeonManaged PostgreSQL database for tenant-isolated proof objects and account dataProductUSASOC 2 Type II
UpstashRedis for rate limiting and queueingProduct + siteUSASOC 2
Google Cloud PlatformSecret Manager and supporting infrastructure servicesProductUSASOC 2, ISO 27001
StripePayment processing for billing and subscriptionsProductGlobalPCI DSS Level 1, SOC 2
GoogleOAuth sign-in for product workspace loginProductGlobalISO 27001, SOC 2
ResendTransactional email for service and notification messagesProduct + siteUSASOC 2
AttioCRM for sales and marketing contactsMarketingUSASOC 2
Apollo.ioWebsite-visitor enrichment, consent-gatedMarketingUSASOC 2
TelegramOperational lead and telemetry notifications to the founding team, consent-gatedMarketingGlobal—
Last reviewed: 2026-07-08. Certification statuses are based on publicly available attestations from each subprocessor. Valty does not independently audit subprocessor certifications.
Security incident log
Publicly disclosed security events.
Valty will update this log when a security incident meets the disclosure threshold: confirmed unauthorized access to customer data, material service compromise, or regulatory notification requirement. No events to disclose at this stage.
DateSeveritySummaryStatus
n/aNone recordedNo security incidents to disclose at this stage. This log will be updated on confirmed events.No action required
Security contact
Report a vulnerability or request security documentation.
Security researchers, buyers, and design partners can reach the Valty security team at security@valty.ai. We acknowledge inbound security disclosures within three business days and target remediation timelines based on severity. NDA and DPA requests route through the same address.
Vulnerability disclosure
Coordinate all vulnerability reports through security@valty.ai. Include reproduction steps, scope, and severity assessment. We do not operate a public bug-bounty program at this stage; all disclosures are handled directly.
PGP key
A PGP public key is available on request for encrypted disclosure. Contact security@valty.ai to receive the key fingerprint before sending sensitive material. Key rotation follows annual cadence or on personnel change.
Data processing agreement
Customers requiring a formal DPA (GDPR / CCPA / enterprise procurement) should request the baseline via security@valty.ai. The DPA is reviewed by legal counsel and provided under NDA for enterprise and design-partner engagements.
Response SLA
Initial acknowledgement: three business days. Severity assessment shared with reporter: ten business days. Confirmed data-incident notification: within 72 hours. Remediation timeline: dependent on severity, critical within 30 days, high within 90 days. Response timelines are operational targets, not contractual guarantees, at design-partner stage.
Security review
Request documentation for procurement, diligence, or design-partner evaluation.
Security questionnaires, DPA, architecture diagrams, and design-partner NDA route through security@valty.ai. The proof page shows what a Valty proof artifact contains before you commit to an engagement.