Data processing information.
What Valify processes, where it goes, who can see it, and how long it is kept. This is the information most procurement and legal teams ask for before approving a new supplier.
Last reviewed: February 2026
What this document is, and is not
This is a factual description of how Valify handles data. It is not a Data Processing Agreement, it is not a contract, and it creates no legal obligations on its own.
If your organisation requires an executed DPA, a Standard Contractual Clauses package, or answers on headed paper, email privacy@valify.co.uk and we will arrange it. We would rather do that properly than have you rely on a web page.
Roles
In the language of UK GDPR: you are the data controller for the documents you upload and their contents. Valify is a data processor, acting on your instructions — an instruction being, in practice, you uploading a document and asking for it to be reviewed.
For your own account details (your name, email address, company and billing information) Valify is the controller, because we decide what to collect in order to run the service and bill for it.
What is processed
| Category | What it is | Why |
|---|---|---|
| Uploaded documents | The RAMS or method statement files you upload, and their full text. These may contain site addresses, named personnel, job details and anything else your document happens to include. | To produce the review you asked for. |
| Reports | The structured findings Valify produces from a document. | To show you the result and keep your history. |
| Account data | Email address, company name, company size, role, and how you found us. | To run your account and support you. |
| Acceptance and sign-off records | Who accepted a document, when, what the report said at that moment, and the exact wording they agreed to. | Because that record is the point of the product. It is insert-only and cannot be edited afterwards. |
| Billing data | Subscription status and invoice history. Card details never reach Valify — they are entered on Stripe’s own pages. | To take payment and issue invoices. |
Sub-processors
These are the third parties that necessarily touch data in order for Valify to work. Each operates under its own terms; we do not have visibility into their internal operations beyond what they publish.
| Sub-processor | What it handles | Sees document content? |
|---|---|---|
| Supabase | Authentication, database, and file storage | Yes — documents are stored here |
| OpenRouter | Routes extracted document text to the AI model | Yes — text passes through |
| Anthropic | The model that performs the analysis (currently Claude Sonnet, reached via OpenRouter) | Yes — text is analysed |
| Vercel | Application hosting | In transit, while a request is served |
| Stripe | Payments and billing | No |
| Resend | Transactional email | No — emails carry counts and file names, never document contents |
Model training
Your documents are not used to train AI models. This is enforced on every request, not left to a configuration setting: each call to the model explicitly refuses any provider that collects or retains data for training, and a provider that will not accept that condition is not used.
There is an automated test asserting that this condition is present on the request, so it cannot quietly stop being sent in a future change.
Retention and deletion
Uploaded documents and their reports are deleted 90 days after upload. A scheduled job runs daily and removes both the stored file and the database record.
Deleting your account removes your documents and reports. Billing records are kept separately for as long as UK accounting and tax law requires, which is a legal obligation rather than a choice.
Security measures
- Documents are encrypted in transit (TLS) and at rest in storage, and are held in a private bucket with no public read access.
- Every database query from a browser runs under row-level security, so one customer’s account cannot read another’s data even if the application had a bug.
- Files are never read directly from the browser — access goes through short-lived signed URLs issued by our backend.
- Shared report links are authorised by a token that is stored only as a SHA-256 hash, expire automatically, and can be revoked.
- Passwords are hashed by Supabase Auth and are never visible to Valify.
Your rights, and how to exercise them
You can access, correct, export or delete your data. Account settings cover most of it directly; for anything else email privacy@valify.co.uk and we will action it within the statutory timeframe.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office.
What we do not claim
Being straightforward about the limits of the above:
- No security certifications. Valify is not ISO 27001 certified, has not completed a SOC 2 audit, and has not had a third-party penetration test. Our sub-processors hold their own certifications; we do not inherit them.
- Hosting regions are not guaranteed in writing. Our sub-processors operate globally. If your organisation requires data residency in the UK or EEA, ask us before signing up — we will confirm the current configuration in writing rather than have you assume it from this page.
- International transfers. Some sub-processors are US-based, so data may be transferred outside the UK under their own transfer mechanisms. We can provide the detail on request.
- No cyber-liability insurance is claimed here. Ask if your procurement process requires evidence of cover.
See also our Privacy Policy, Security page, Terms of Service and limitations.