Access control
Single sign-on with Microsoft, Google or Okta, two-step sign-in, and security groups by role and department.
Trust Center
Security your vendor management team can sign off on.
How ValiBench protects agency data, what is public, and what we share on request.
At a glance
| Area | Status |
|---|---|
| SOC 2 | Designed and run to the SOC 2 trust services criteria. Independent SOC 2 audit planned; no report yet. |
| Insurance | General liability, cyber liability and professional liability in force. Certificate of insurance on request. |
| Hosting | United States (Virginia). Encrypted in transit and at rest. |
| Client data | Fictional test data only, by contract. Screenshots are checked and personal details covered before they are saved. |
| AI | No training on customer data. People review AI output and make every decision. |
| Incident notice | Within 72 hours of confirming unauthorized access to an agency's data (Customer Agreement §10.2). |
| Retention | Screenshots and vendor documents deleted after 3 years; all agency data exportable at any time and deleted 30 days after the subscription ends. |
Controls
One agency, one boundary
Each agency's data is kept separate from every other's. Administrators decide who sees what.
Audit trail
Every sign-in, change, approval and sign-off is recorded with who and when.
No connection to your systems
ValiBench never connects to or changes an agency's systems. People test by hand and record what they find.
Backups and export
Regular backups, and every agency can export its data in one file whenever it asks.
Monitoring and change control
Automated security checks every day; every code change goes through a pull request and the automated test suite before release.
Service providers
These are the companies that handle agency data to help us run ValiBench. Each works under a contract that limits how it may use that data. We tell customers before we add a new one.
| Provider | What it does for ValiBench | Location |
|---|---|---|
| Render | Runs the ValiBench app and stores its database and uploaded files | United States (Virginia) |
| Cloudflare | Website hosting, network security and protection from attacks | Global network |
| Postmark | Sends app emails, such as invitations, reminders and alerts | United States |
| Stripe | Processes subscription payments; holds card and bank details | United States |
| Anthropic | AI behind Ask Vali, release notes and vendor document reviews; does not train on customer data | United States |
| Microsoft 365 | Business and support email; storage for backups | United States |
Last updated November 4, 2026.
Documents
Our legal documents are public. Security documents are confidential and shared with agencies evaluating or using ValiBench.
| Document | Access |
|---|---|
| Customer Agreement | Public |
| Privacy Policy | Public |
| Website Terms of Use | Public |
| Security overview | On request |
| Completed security questionnaire (SIG Lite, or yours) | On request |
| Service provider (subprocessor) list | Public |
| Certificate of insurance | On request |
| Data retention and deletion summary | On request |
| SOC 2 report | Not yet available (audit planned) |
Request documents
Tell us what you need. A person replies by email, usually within one business day.
Thank you. We'll be in touch.
Your request went to ValiBench's security team. Expect a reply by email, usually within one business day.
Found a security issue? Email [email protected].