Valora

Security

Valora handles confidential commercial real estate data. The notes below describe how the product is actually built today — not a future certification roadmap.

Data encryption

All traffic to and from Valora is encrypted in transit with TLS 1.2 or newer. Customer data — including documents, valuations, and AI conversations — is encrypted at rest in our managed Postgres database and object storage.

Where data lives

The customer file-room, database, authentication store, and object storage run on Supabase in Stockholm (EU). Application hosting and the agent runtime run on Google Cloud Run in europe-west1. Cloud Run's region is not the Vertex model location.

Multi-tenant isolation

Valora is multi-tenant. Every record is scoped to an organization and enforced at the database layer using row-level security (RLS) policies. A user can only read and write data that belongs to an organization they are a member of, regardless of how the request is made.

Authentication and access control

Authentication is handled through Supabase Auth using email magic-link sign-in. There is no multi-factor authentication (MFA). Inside an organization, members have one of two roles — admin or analyst — and platform-level administration is a separate flag. Service-role credentials that bypass RLS are only used in trusted server-side code where the organization context is verified explicitly.

AI processing

Inference runs on Google Vertex AI in GCP project veridian-ai-466807. Location is per model, not one process-wide region:

  • Gemini 3.5 Flash and proprietary embeddings (gemini-embedding-001, for EU-required orgs) use Vertex location eu (https://aiplatform.eu.rep.googleapis.com).
  • Gemini 3.6 Flash, 3.7 Flash, 3.8 Flash, and Gemini 3 Flash use the Vertex global multi-region endpoint.

Web search runs through Exa (hosted MCP,web_search_exa) with a platform API key. Query text leaves Google's Vertex path for that tool call. Per Google's Vertex AI terms, as documented in our own product terms, customer prompts and model outputs used for chat/embeddings are not used to train Google's models. Prompts include only the project and organization context that the requesting user already has access to.

Subprocessors

  • Supabase (Stockholm) — Postgres database, authentication, and file storage.
  • Google Cloud — Cloud Run in europe-west1, plus Vertex AI for chat and embeddings.
  • Exa — Platform web search via hosted MCP.

Operational practices

  • Code changes go through pull-request review before being deployed to production.
  • Database migrations are versioned, append-only, and reviewed alongside the code change that depends on them.
  • Production secrets are managed in our hosting platform's environment store and are not committed to source control.
  • Logs and metrics are retained only as long as needed to operate and debug the service.

Reporting a vulnerability

If you believe you have found a security vulnerability in Valora, please email herman@vardenlab.com. We appreciate disclosure that gives us a reasonable window to investigate and resolve the issue before it is shared publicly.