Security
Security
Valtair builds and operates software that handles client data, so security is part of how we engineer, not a page we bolt on. This is our approach to handling data and running infrastructure. Specifics for a given engagement are shared under the engagement.
Data handling
- Collect only the data a system needs to do its job.
- Separate client data by tenant and by environment.
Encryption and infrastructure
- Encrypt data in transit and at rest.
- Run on managed cloud infrastructure with least-privilege defaults.
- Keep production isolated from development and staging.
Access and secrets
- Role-based access control, granted on need.
- Secrets held in a managed secret store, not in code.
Vendors and backups
- Back up critical data.
- Prefer providers that do not train on customer data by default.
Secure development and response
- Code review and dependency checks as part of delivery.
- Monitoring and alerting on production systems.
FAQ
Common questions
Do you hold certifications like SOC 2 or ISO 27001?
We describe the practices we follow rather than claim certifications we do not hold. If your project requires a specific standard, tell us and we will be honest about where we stand and what it would take to meet it.
Is our data used to train models?
We prefer providers and configurations that do not train on customer data, and we confirm this per engagement based on the providers involved.
How are prompts and outputs handled?
Prompts and outputs are treated as client data: separated by tenant, encrypted, and retained only as long as the system needs them, per the terms of the engagement.
Can you support data residency requirements?
Yes, where the underlying providers support the region you need.
Questions about Security?
We are happy to walk through how this applies to your project.