Security & privacy
What's actually implemented, described plainly.
This page lists the access controls and data-handling practices Valyo has actually built — not a certification claim. Valyo has not pursued or received SOC 2, ISO 27001, or any other formal security certification, and doesn't represent otherwise.
Implemented controls
Encrypted in transit
All traffic to Valyo is served over HTTPS.
Organization-scoped data
Every client, comparable, valuation, and report belongs to one organization and is enforced at the database-query level — not just hidden in the interface. A team member can never reach another organization's data through the product.
Role-based access
Team members hold a role (Owner, Admin, Agent, or a restricted view-only role), and every action a Realtor can take is checked server-side against that role before it runs.
Private report storage
Generated PDF reports are stored privately, not on a public URL an outside party could guess or stumble onto.
Server-side credential handling
API keys and provider credentials are used only in server-side code and are never exposed to the browser.
Rate limiting
Login, AI-assisted analysis, and report generation are all rate-limited to reduce abuse and accidental overload.
Audit logging
Actions that change data — editing a comparable, adding a team member, generating a report — are recorded with who did what and when, visible to the organization's own admins.
Data-source governance
External data sources are governed individually — see our Data Architecture page. An unrecognized or unlicensed source is treated as fully restricted by default, not assumed permitted.
Data minimization
Valyo stores what a Realtor's own workflow actually needs — client name, email, phone, and property details — not an enriched or inferred profile beyond that.
Realtor oversight, by design
Every valuation is produced by a deterministic, versioned methodology, not an unconstrained AI model — see how it works on the homepage. A generated valuation run is never silently changed after the fact; regenerating it always creates a new, separately recorded version rather than overwriting history, so a report can always be reproduced exactly as it was when it was sent.
Honest, current limitations
Tenant isolation today is enforced in application code (every query scoped to an organization), not additionally at the database row-security level — acceptable at Valyo's current stage, and something we intend to revisit as the platform takes on real customer data at scale. No third-party security audit or penetration test has been performed to date.