Security

01 · The check

What a check touches, and what it never does

A check reads what your app already shows to any visitor, the way a browser would. It never signs in, fills in a form or changes anything.

• It connects only to public addresses. Private, local and cloud metadata addresses are refused, again at every redirect.
• When your pages carry a Supabase address and its public key, it asks up to ten tables for one row each and records whether a row came back, never the row.
• Public registries receive a package name and version, or your domain name. Never your code, a key or a page.
• Every request names itself: its user-agent starts with VallitBot/ and links vallit.net/bot. The checks run in Vercel’s Frankfurt region, whose outgoing addresses are shared and change, so there is no fixed IP to allow. A firewall that challenges bots should let that user-agent through, or the report says your app did not respond.

02 · Ownership

How we know the app is yours

The first check starts only after you tick that you own the app, or were asked by its owner. Your answer is stored with the check.

• The close watch and the AI sample go further, so they need a confirmed domain: a TXT record named _vallit in front of your address, which only someone who controls the domain can add.
• If you let Vallit add the record with a Cloudflare token, the token is used once and never stored, logged or shown again.
• To stay a polite visitor, one domain can be checked three times an hour, and one visitor can start five checks an hour.

03 · Code and fixes

Access to your code, and to your fixes

Code checks run only after you connect a GitHub repository. The Vallit GitHub App asks to read the contents and metadata of the repositories you share with it.

• Its access token is made for one check and expires within the hour. No token is stored.
• The repository is read into memory at one revision. Nothing is written to disk and none of your code is run.
• Because the access is read-only, no fix arrives as a pull request today. The pull request path is off until you tick it for an app, and needs write access first.
• When it runs, a fix is one commit on a new branch, opened as a pull request. Vallit never merges and never writes to your default branch, and a person at Vallit approves every fix before it goes out.
• Vallit asks for no access to your hosting, your deploys or your database password.

04 · Your data

Where your data lives, and for how long

The app runs in Vercel’s Frankfurt region and its database is on Supabase in Frankfurt (eu-central-1).

• A check started without an account, and monitoring results, are deleted after 90 days. Reports in your workspace stay until you delete the workspace.
• A check from the front page stores a shortened hash of your IP address, used to count checks per hour, not the address itself.
• Deleting a workspace deletes its apps, monitoring and settings. Its reports keep working under their links, with the workspace, the IP hash and the email address removed.
• A business that needs a data processing agreement under Art. 28 GDPR gets one from us: write to info@vallit.net with the company’s name and address.

05 · Encryption

Encryption, and the secrets we never keep

Every connection to Vallit is encrypted. app.vallit.net tells browsers to reach it over HTTPS only, and to remember that for two years.

• The database sits on Supabase’s encrypted storage. Vallit adds no encryption of its own on top; it keeps secrets out instead.
• A key we find is kept by its kind, its public prefix, its length and a fingerprint that recognises it in a later check. Its value is never stored.
• No GitHub token, no Cloudflare token and no model key is stored either. The AI Gateway is reached with the deployment’s own identity.

06 · People

Who at Vallit can see what

Each workspace is kept apart by row-level security in the database. One workspace cannot read another’s apps or reports.

• Only people on Vallit’s operator list, checked on the server against an email address the sign-in provider has verified, can open the operator console. It shows every check, including an email address a visitor left.
• The team is emailed when a check finds something critical, when a visitor leaves an address and when a fix is requested.

07 · Services

Services Vallit runs on

The privacy policy names what each of them processes, and on what basis.