Security & Data Protection Policy

Valueye Technologies treats security as a lifecycle responsibility spanning discovery, architecture, implementation, review, deployment, operation, and recovery. Controls are selected according to the data involved, the applicable threat model, the chosen infrastructure, customer responsibilities, and contractual requirements.

Valueye designs hosted systems to protect sensitive information throughout collection, transmission, storage, use, retention, and deletion. The specific safeguards depend on the product and deployment model.

• 01Data in Transit: Public and service-to-service connections are designed to use secure transport supported by the selected platform and integration.
• 02Data at Rest: Databases, object storage, backups, and other persistent stores use appropriate platform encryption capabilities when included in the solution architecture.
• 03Secrets and Keys: Credentials, tokens, and encryption keys are kept outside application source code and managed through access-restricted platform facilities appropriate to the environment.
• 04Retention and Deletion: Data retention, archival, and deletion requirements are defined by product needs, legal obligations, and customer agreements.

Valueye designs application and administrative access around least privilege, role-based permissions, strong authentication, environment separation, and auditable changes. Logical or physical isolation is chosen according to workload sensitivity, architecture, and contractual scope.

• 01Access is limited to people and services with an operational need.
• 02Production, staging, development, and customer environments are separated as required by the deployment model.
• 03Privileged activity and change history are made observable where supported and included in scope.
• 04Customer-operated environments remain subject to the customer's identity, access, and infrastructure responsibilities.

Availability targets, backup schedules, retention periods, restoration procedures, incident responsibilities, recovery point objectives, and recovery time objectives are defined for the individual product or engagement. Valueye does not represent a universal recovery guarantee across every system.

• 01Logging and alerting are designed around important operational and security signals.
• 02Backup and restoration controls are selected for the data, platform, and agreed recovery requirements.
• 03Incidents are triaged according to impact, containment needs, customer responsibility, and communication requirements.
• 04Material lessons are used to improve architecture, controls, documentation, and operating procedures.

Valueye uses code review and security testing practices appropriate to the engagement, which may include dependency analysis, static analysis, configuration review, focused security assessment, or independent testing when expressly scoped. Reports from security researchers can be sent to security@valueye.in.

• 01Include the affected asset, reproduction steps, observed or potential impact, and a safe contact method.
• 02Do not access or alter unrelated data, degrade availability, use social engineering, or attempt physical intrusion.
• 03Allow reasonable time for investigation and remediation before public disclosure.
• 04The canonical machine-readable disclosure contact is published at https://valueye.in/.well-known/security.txt.