Security

01 · The check

What a check touches, and what it never does

A check reads what your app already shows to any visitor, the way a browser would. It never signs in, fills in a form or changes anything.

• It connects only to public addresses. Private, local and cloud metadata addresses are refused, again at every redirect.
• When your pages carry a Supabase address and its public key, it asks up to ten tables for one row each. It records whether a row came back, never the row.
• Public registries receive a package name and version, or your domain name. Never your code, a key or a page.
• Every request names itself: its user-agent starts with VallitBot/ and links vallit.net/bot. The checks run in Vercel’s Frankfurt region, whose outgoing addresses are shared and change, so there is no fixed IP to allow. A firewall that challenges bots should let that user-agent through, or the report says your app did not respond.

02 · Ownership

How we know the app is yours

The first check starts only after you tick that you own the app, or were asked by its owner. Your answer is stored with the check.

• The close watch and the AI sample go further, so they need a confirmed domain. That is a TXT record named _vallit in front of your address, which only someone who controls the domain can add.
• If you let Vallit add the record with a Cloudflare token, the token is used once and never stored, logged or shown again.
• To stay a polite visitor, one domain can be checked three times an hour, and one visitor can start five checks an hour.

03 · Code and fixes

Access to your code, and to your fixes

Code checks run only after you connect a GitHub repository. The Vallit GitHub App asks, on the repositories you share with it, to read and write contents, pull requests and issues, to set commit statuses and to read metadata. GitHub lists this before you install it.

• Its access token is made for one check and expires within the hour. No token is stored.
• The repository is read into memory at one revision. Nothing is written to disk and none of your code is run.
• A fix arrives as a pull request only for an app where you ticked pull requests, once your installation has accepted write access.
• When it runs, a fix is one commit on a new branch, opened as a pull request. Vallit never merges and never writes to your default branch, and a person at Vallit approves every fix before it goes out.
• Vallit asks for no access to your hosting, your deploys or your database password.

04 · Your data

Where your data lives, and for how long

The app runs in Vercel’s Frankfurt region and its database is on Supabase in Frankfurt (eu-central-1).

• A check started without an account, and monitoring results, are deleted after 90 days. Reports in your company stay until you delete the company.
• A check from the front page stores a shortened hash of your IP address, used to count checks per hour, not the address itself.
• Deleting a company deletes its apps, monitoring and settings, and the reports that read its code. Its other reports keep working under their links, with the company, the IP hash and the email address removed.
• A business that needs a data processing agreement under Art. 28 GDPR gets one from us: write to info@vallit.net with the company’s name and address.

05 · Encryption

Encryption, and the secrets we never keep

Every connection to Vallit is encrypted. app.vallit.net tells browsers to reach it over HTTPS only, and to remember that for two years.

• The database sits on Supabase’s encrypted storage. Vallit adds no encryption of its own on top; it keeps secrets out instead.
• A key we find is kept by its kind, its public prefix, its length and a fingerprint that recognises it in a later check. Its value is never stored.
• No GitHub token, no Cloudflare token and no model key is stored either. The AI Gateway is reached with the deployment’s own identity.

06 · People

Who at Vallit can see what

Each company is kept apart by row-level security in the database. One company cannot read another’s apps or reports.

• Only people on Vallit’s operator list, checked on the server against an email address the sign-in provider has verified, can open the operator console. It shows every check, including an email address a visitor left.
• We get an email when a check finds something critical, when a visitor leaves an address and when a fix is requested.

07 · Services

Services Vallit runs on

The privacy policy names what each of them processes, and on what basis.