Is it safe for my app?
Does a check change anything on my app?
A check reads. It does not sign in or submit changes to your app. Every request uses GET, HEAD or OPTIONS, which are meant for reading, and names VallitBot in its user agent.
A server can still implement these methods with side effects.
Could a check slow my app down?
A check sends at most three requests at a time, at least 150 milliseconds apart. One domain, counting its subdomains, can be checked three times an hour.
Vallit sends no attacks and does not test how much load your app takes.
What does a check ask my app for?
The page at your address, the scripts it loads, a fixed list of addresses where apps leak files or admin tools by mistake, and your certificate. It also tests up to 12 of your links that forward visitors elsewhere.
If your pages carry a Supabase address and public key, it asks up to ten tables for one row each and records only whether a row came back.
Does Vallit copy my customers’ data?
No. A check does not sign in. A finding about your live site records the shape of what it saw, not the content.
A key is recorded by its kind, its public prefix, its length and a fingerprint. An environment file is recorded by its variable names, never their values.
Does Vallit read my code?
Only after you connect a GitHub repository to an app on Watch or Care. The free check and apps on Free never have their code read.
A check reads the repository in memory at one commit, writes nothing to disk and runs none of your code. It keeps the repository’s name and the commit’s id. A finding keeps the line it names, with known keys masked.
To confirm a finding, the code on its path goes to language models. The filter that masks keys does not catch every secret.
Who can read my report?
Anyone who has its link. A report opens from a long random link and needs no account, so share it the way you would share the findings.
How long does Vallit keep my data?
A report that no company holds, and monitoring results, are deleted after 90 days. Reports that read your code are deleted with the company or the app.
A model’s cached verdict on your code is kept for 30 days. A nightly encrypted copy of Vallit’s database is kept for 14 days.
How do I delete my data?
Delete an app or the company in the app. That removes the apps, their monitoring results, incidents and settings, and the reports that read your code.
Reports of your live site stay readable under their links with the company, the app and contact details removed. This is not full erasure: their addresses and results remain until they are more than 90 days old.
Deleting a company does not cancel a paid plan with Stripe. End the plan first, under Billing.
Does AI read my app or my code?
In two places. Vera, our AI, reads every finding of the checks that follow a request or a rule through your code. What it can rule out as a false alarm is left out of your report.
Now and then it also reads what the daily check already saw of an app with a confirmed domain. The model never contacts your server. The box Include this app in the sample under Settings leaves an app out of that sample.