Cybersecurity Policy

This policy describes the security measures Valont Pty Ltd (ABN 79 682 227 934) ("Valont", "we", "us") maintains to protect the platform and your data, and what we need from you to keep your account secure. It forms part of our Terms of Service (see clause 10.4 of the Terms).

• Defence in depth: multiple layers of controls across network, application, data and identity
• Least privilege: access is limited to the minimum required for each role or system
• Secure by default: new features and integrations must be secure out of the box
• Assume breach: systems are designed to limit blast radius and enable rapid detection and response

Your data is hosted primarily in Australian regions (Sydney), including our application database, analytics warehouse and document storage.

Some data is processed or stored outside Australia:

• AI requests, including voice transcription and AI interviews, are processed by overseas providers, which may not train their own models on your data and keep it only as described in section 4
• Operational data, such as system logs, error reports, product usage analytics, and records of emails sent and payments made, may be processed and stored by our service providers in the United States. We limit this data to what is needed to run, secure and support the platform

Overseas providers are subject to the controls in section 6, and are described in our Privacy Policy.

• Encryption: data is encrypted in transit (TLS) and at rest
• Tenant isolation: each customer’s data is separated using database-level access controls, designed so that one customer cannot see another’s data
• Access control: role-based access for your users (managed by you) and least-privilege access for our staff and contractors, with multi-factor authentication
• Device security: the Valont iOS app stores sign-in details in the device’s secure storage, not in plain app storage
• Secure development: changes are code reviewed and pass automated checks before they are released

AI providers process your data only to provide their services to us. They are contractually restricted from training their own models on your data, and keep it only as long as needed to provide the service and for limited security monitoring. This applies to voice transcription and AI interviews as well as the AI advisor. AI outputs are subject to guardrails, and AI systems operate within defined data boundaries.

• Logging, monitoring and alerting across the platform
• Monitoring of security advisories for the software and services we rely on, with fixes prioritised by severity
• Audit logs of key actions, such as AI agent decisions and changes to business information
• We plan to commission independent penetration testing as the platform grows

We use established infrastructure and service providers under contracts that cover how they handle data. We consider a provider’s security before we start using it, and review the providers that process your data from time to time.

Team members and contractors who help deliver our services, including those outside Australia (currently in the Philippines and Indonesia), work under written confidentiality and security obligations. They access Customer Data only through Valont-managed systems, or with their own individual login to software used for our services (such as Xero), using multi-factor authentication, and only to the extent their work requires. Their access is removed when the work or engagement ends.

• Security incidents are triaged by severity, with a defined incident response procedure and a nominated incident commander
• If a breach is likely to result in serious harm, we notify the OAIC and affected individuals under the Notifiable Data Breaches scheme
• We tell affected business customers as soon as practicable after we confirm an incident affects their data
• We review significant incidents after they are resolved and act on what we learn

Security is shared. You must:

• Keep credentials secure and confidential: logins must not be shared between users
• Manage your users’ access and remove it promptly when no longer appropriate
• Keep your own devices, networks and Connected Systems accounts secure
• Notify us promptly of any actual or suspected security incident

We use recognised standards, including the OWASP Top 10 for application security, as reference points for our controls. Valont is not currently certified against SOC 2 or ISO 27001.

Each version of this policy carries a version number and effective date. For material changes we will notify you and ask you to re-accept the updated version.