Built for regulated operators.
Valix is built with encryption at rest and in transit, immutable audit logs, and role-based access control. Every transaction logged. Every change traceable. Your data stays yours.
Controls
Security controls across the full stack
Access controls, encryption, change management, and incident response are built into the platform — with immutable audit logs across every layer.
Encryption
TLS 1.3 in transit, AES-256 at rest
All data moves encrypted, on managed cloud storage that encrypts at rest by default. Admin access is gated by role-based permissions and mandatory multi-factor authentication, and every action is written to an audit log.
Access
Role-based permissions down to the transaction
Assign permissions by property, entity, or function. Every user action and every AI decision is timestamped and immutable. Compliance teams can export full audit trails for regulatory review.
Direct answers. No hedging.
Common questions from CISOs, auditors, and procurement teams. Anything not covered here, our security team will answer under NDA.
What happens in a breach?
We notify affected parties within 24 hours and file required disclosures. Sensitive fields are encrypted at rest with AES-256-GCM and all traffic is encrypted in transit, limiting exposure. We maintain a written incident response plan.
How do you approach security controls?
Security is built around least-privilege access, encryption in transit and at rest, and immutable audit logs on every financial action. We're happy to walk enterprise security teams through our current controls in detail under NDA.
Do you handle GDPR and CCPA?
Not yet. Valix is US-hosted and built for US operators: we have not completed a GDPR or CCPA compliance programme, there is no standard data processing agreement to sign today, and we do not offer EU hosting. Access, correction and deletion requests are handled by hand on request — ask and we will show you exactly what we hold.
Can we audit your logs?
Every financial transaction is logged with timestamp, user, IP, old-value and new-value. You can export the audit trail as CSV from the admin audit log. Third-party auditors can request access under controlled conditions.
What about backups and recovery?
The production database is backed up daily, checksummed, and retained for 30 days. Every restore is checksum-verified and run through a ledger balance check (debits equal credits) before it's trusted.
How is access controlled?
Role-based access control enforced at the edge: every /api/* path is checked against a role manifest before the handler runs, viewer roles are read-only by default, and each portal role reaches only its own endpoints. Sign in with Google or Microsoft is supported today; SAML-based enterprise SSO is on the roadmap for Enterprise accounts. MFA is required for all admin roles. Standard session tokens last 24 hours (2 hours for admin-tier roles); impersonation tokens are capped at 30 minutes regardless of activity.