Security & data handling

Your data is the engagement.

Most of our work runs on client data — documents, tickets, records, production traffic. Handling it carefully isn't a compliance checkbox for us; it's the substance of the job. This page describes our baseline practices. Engagement contracts and DPAs can extend them; they never weaken them.

Data handling in engagements

Least access. We ask for the minimum data needed for the work, prefer redacted or sampled datasets where they suffice, and access production systems only when the engagement requires it.
Your boundary, when possible. Where your infrastructure allows, we work inside your environment — your cloud accounts, your VPN, your keys — so data never leaves your control at all.
No cross-client use. One client's data is never used for another client's benefit, for our own products, or to train models for anyone.
Deletion on exit. At the end of an engagement we delete or return client data as the contract specifies, and confirm it in writing.

Third-party model providers

Most engagements involve sending data to one or more AI model providers. Before any of your data reaches one, we tell you which providers are involved and under what terms — including whether the provider trains on API data (the major providers offer no-training, zero-data-retention (ZDR) terms, and we default to them), where the data is processed, and what retention applies. If your compliance posture rules out external APIs entirely, we design around open-weight models in your own environment instead.

Access control

Named individual accounts only — no shared credentials. Hardware-key or app-based multi-factor authentication on every account that touches client systems.
Client credentials live in a managed secrets vault, never in code, tickets, or chat.
Access is revoked at engagement end, and on request at any time.

Secure development practice

Code review before merge; dependency and secret scanning in CI.
Full-disk encryption and screen-lock policies on every workstation.
AI-specific threats — prompt injection, data exfiltration through tool use, over-privileged agents — are treated as first-class security concerns in design review, not addressed after the fact.

Incident response

If an incident affects your data, we notify you without unreasonable delay — our contractual standard is 72 hours or better — with what we know, what we've contained, and what happens next. We don't sit on bad news.

Reporting a vulnerability

If you believe you've found a security issue in anything we operate, email security@vallesai.com. We acknowledge reports within two business days, and we don't pursue action against good-faith research.

Last reviewed: August 18, 2026