Where documents are stored
Uploaded documents are stored in a private Supabase Storage bucket with encryption at rest by default. Signed-in users can upload documents into their own account folder and delete their own files under storage access policies. Document downloads use short-lived signed URLs issued by our backend after it checks ownership.
Encryption standards
Documents are encrypted in transit using TLS 1.2 or higher between your browser and our servers, and encrypted at rest in storage.
How documents are processed
Uploaded documents are stored in Supabase Storage. Extracted content is routed through OpenRouter to the configured review model to generate your analysis. Each review request excludes model endpoints that collect data for training. This training restriction is separate from zero-data-retention routing: provider logging and retention are governed by the applicable provider policies, and we do not promise that every processor deletes all content immediately after a response.
Data retention
Documents and reports are retained for 90 days from upload and are then permanently deleted. Customers can request or perform earlier deletion where available. Account and billing records are retained separately as required for legal and accounting purposes.
Document audit trail
Every review decision made in Valify — acceptance or return for revision — is logged with a timestamp and the identity of the person who made it. They are stored in Supabase with row-level security ensuring only your account can access your own records, and are available to export on request.
A decision record is written once and never rewritten: there is no update or delete path from the browser, so a decision cannot be quietly amended after the fact. Changing your mind means uploading the revised document, which produces a new report and a new decision alongside the original rather than in place of it.
Decision records are kept with the document, and go when it does. They are deleted along with the document and its report 90 days after upload, or sooner if you delete it yourself. We would rather say that plainly than describe the audit trail as permanent: the 90-day promise above applies to the whole record of a document, and an exception carved out of it would make that promise worth less. If you need a decision on file for longer than 90 days, export it before then — email support@valify.co.uk and we will send you the records for your account.
Who can access uploaded documents
Access to uploaded documents is restricted to the automated processing pipeline and a small number of authorised Valify personnel for support and debugging purposes only. Document downloads in the browser use short-lived signed URLs issued by our backend after an ownership check; the document bucket is not public.
GDPR compliance
Valify is built to be compliant with UK GDPR and the Data Protection Act 2018. You have the right to access, correct, or request erasure of your data at any time — see our Privacy Policy for full detail, including how to make a data request.
Third-party processors
Valify uses the following third-party processors (sub-processors), each bound by its own data processing terms:
- Supabase — authentication, database and document storage
- OpenRouter — routes document content to the AI model used for analysis (currently Anthropic Claude)
- Stripe — payment processing and billing
- Resend — transactional email delivery
- Vercel — website hosting and content delivery
See our Privacy Policy for the full sub-processor list and international transfer safeguards.
Reporting a security concern
If you believe you have found a security issue affecting Valify, email security@valify.co.uk with the details and we will respond as a priority. If you are not sure whether something counts as a security issue, send it there anyway — we would rather read one that turns out to be nothing.
See what Valify finds in your documents.
3 free scans. No card required. No commitment.
Try 3 free scans