Keeping watch
How often is my app checked?
Every app is checked once a day on any plan. An app on Watch or Care with a confirmed domain also gets the five-minute watch: whether it answers.
The schedule follows each app’s own plan, not the company’s.
How do I confirm my domain?
You add one TXT record to your domain’s DNS. It is named _vallit in front of your app’s address, and its value starts with vallit-verification=. The app’s page shows the exact record.
One click would add it on your provider’s own page, but only where the provider has approved Vallit, and none has yet. For now you add the record by hand, or with a Cloudflare token for that one zone. Vallit never signs in to your provider.
Confirming shows where the findings of the targeted checks sit, and on Watch or Care it turns on the five-minute watch.
I added the record, but Vallit does not find it
DNS changes can take up to an hour to travel. If you added it just now, wait, then click Look for the record.
If it still fails, copy the whole value again. A record that holds an older or mistyped code must be replaced with the one the panel shows.
What emails will Vallit send me?
Three can reach you. An incident opens: the app stops answering, its certificate fails or a security header goes missing. Something new and serious turns up. A finding is confirmed fixed.
They go to one main address and up to four more, set under Alerts in the company settings. The incident email needs the app on Watch or Care. A day with nothing new sends nothing.
What is a trust page?
A public page for one app that lists the checks that passed, with the date. It never shows a finding, a score or where a weakness is.
It needs a confirmed domain and no critical or high finding open when you publish. It is not an audit or a certification.