Security at Valiro

Last updated: 8 July 2026

We take the security of your data seriously. This overview describes the technical and organizational measures (TOMs) we use to protect your projects and information. The legally binding version of these measures is set out in Annex 3 of our Data Processing Agreement (DPA) and in section 22 of our Privacy Policy.

Data Location in the EU

Valiro is operated entirely within the European Union:

  • Hosting, database, file storage and backups are with Hetzner Online GmbH in Germany (EU) — in a data center certified to ISO 27001. We do not operate our own servers.
  • AI processing takes place via EU-capable providers (EdenAI in France; the Google Gemini language model via Google Vertex AI in the EU multi-region).
  • The platform (app.valiro.ai) runs directly on our Hetzner infrastructure; its traffic does not run through Cloudflare — for the platform, Cloudflare only handles DNS resolution.

Encryption

  • In transit: All connections to and from Valiro are consistently encrypted via TLS/HTTPS.
  • Passwords: Passwords are stored exclusively as secure hashes (bcrypt) — never in plain text.
  • Two-factor secrets: When two-factor authentication (TOTP) is enabled, the secret is stored AES-256-GCM-encrypted.

Authentication & Access Control

  • Login with username and password; optional two-factor authentication (TOTP).
  • Automatic lockout after repeated failed attempts and active session management.
  • Role-based permission system (Owner / Admin / Member) following the least-privilege principle; security-relevant access is logged.
  • API access is authenticated via JWT.

Tenant Separation

The data of each organization is kept logically separate via its own identifier (org_id). Production and test systems are separated from each other.

Infrastructure & Defense

  • Our public website is delivered and protected via Cloudflare (DDoS protection, web application firewall).
  • Firewalls, continuous monitoring and timely security updates secure ongoing operation.
  • We provide the software with an availability of 95% on annual average (measured at the data center’s transfer point).

Data Integrity & Logging

Changes and deletions are recorded traceably via activity and audit logs (who, when, what).

Backups & Deletion

  • We create regular, automated backups, stored separately from the production system.
  • Personal data is deleted from the production systems on instruction or after the end of the contract; data contained in backups is overwritten as part of the regular backup cycle.
  • Backups serve exclusively operational security and restoration in the event of a fault — they do not replace the customer’s own data backup.

AI Data Processing

  • AI requests are processed within the EU (EdenAI EU endpoint; Google Gemini via Vertex AI EU multi-region).
  • Your inputs and the generated outputs are not used to train third-party AI models.
  • AI results are marked as AI-generated and must be reviewed by the user; no automated decision-making within the meaning of Art. 22 GDPR takes place.

Reach Measurement Without Tracking

For website analytics we use the self-hosted, cookie-free Umami on our own EU infrastructure. No personal profiles are created and no data is passed on to third parties. Details in our Privacy Policy.

Sub-processors

We use only carefully selected service providers and conclude a data processing agreement pursuant to Art. 28 GDPR with each of them. The complete, current list can be found in Annex 2 of the DPA.

Compliance & Standards

  • GDPR: Processing in accordance with the requirements of the General Data Protection Regulation, including data subject rights and data protection by design.
  • EU data residency: Hosting and processing within the EU/EEA; third-country transfers are safeguarded by an adequacy decision or EU Standard Contractual Clauses.
  • ISO 27001: Operation in a correspondingly certified data center (Hetzner).

Handling of Security Incidents

If we become aware of a breach of the protection of personal data, we notify affected customers without undue delay and provide the necessary information so that they can meet their statutory notification and communication obligations (Art. 33, 34 GDPR — 72-hour deadline).

Review

We review our security measures at least annually and on a case-by-case basis, select and review sub-processors carefully, and commit our employees to confidentiality.

Reporting Security Issues

If you discover a security vulnerability, please report it promptly. We value responsible disclosure and will work with you on a resolution.

Security contact: info@valiro.ai — please include “Security” in the subject line.

FAQ

Security questions, in plain language

How we host, what we encrypt and what happens to the documents you upload.

Where does my data live?

Exclusively on servers in the European Union. All Valiro data — projects, documents, AI embeddings, time entries — is processed and stored inside the EU. We never replicate to third-country regions, and our backups stay inside the same residency boundary.

How is my data protected in transit and at rest?

TLS 1.2+ for everything you send to or receive from the platform. AES-256 encryption at rest for the database and object storage. Documents you upload are encrypted before they reach the storage layer; access requires authenticated API tokens scoped to your tenant.

Which AI models does Valiro use?

A mix of European language models (Mistral, Aleph Alpha) for confidentiality-critical tasks and selected OpenAI / Anthropic models for complex reasoning. All inference runs through EU endpoints with no training on your data. You can constrain the model selection per workspace in the Enterprise plan.

What happens to documents I upload?

Uploaded documents are indexed for the AI workspace and stored within your tenant. They are never shared across tenants, never used to train models, and can be deleted permanently at any time. You retain full ownership.

Contact