Valora

Security

Valora handles confidential commercial real estate data. The notes below describe how the product is actually built today — not a future certification roadmap.

Data encryption

All traffic to and from Valora is encrypted in transit with TLS 1.2 or newer. Customer data — including documents, valuations, and AI conversations — is encrypted at rest in our managed Postgres database and object storage.

Where data lives

The customer file-room, database, authentication store, and object storage run on Supabase in Stockholm (EU). Application hosting and the agent runtime run on Google Cloud Run in europe-west1. Cloud Run's region is not the Vertex model location.

Multi-tenant isolation

Valora is multi-tenant. Every record is scoped to an organization and enforced at the database layer using row-level security (RLS) policies. A user can only read and write data that belongs to an organization they are a member of, regardless of how the request is made.

Authentication and access control

Authentication is handled through Supabase Auth using email magic-link sign-in. There is no multi-factor authentication (MFA). Inside an organization, members have one of two roles — admin or analyst — and platform-level administration is a separate flag. Service-role credentials that bypass RLS are only used in trusted server-side code where the organization context is verified explicitly.

AI processing

Inference runs on Google Vertex AI in GCP project veridian-ai-466807. Location is per model, not one process-wide region:

  • Gemini 3.8 Flash (EU lock) and proprietary embeddings (gemini-embedding-001, for EU-required orgs) use Vertex location eu (https://aiplatform.eu.rep.googleapis.com). Leftover selectors for retired Gemini Flash versions (3.5, 3.6, 3.7) remap to 3.8.
  • Historical Gemini 3 Flash used the Vertex global multi-region endpoint.

Platform web search is configurable per organisation and can be off, Exa (hosted MCP, web_search_exa, Exa Labs, Inc., USA), or Google Web Grounding for Enterprise (Vertex generateContent with enterpriseWebSearch on the EU MLP https://aiplatform.eu.rep.googleapis.com / locations/eu). Off disables both web_search and web_fetch; Exa or Google enables both. Enforced in code, not only by prompt instructions.

The HTTP call for Google Web Grounding for Enterprise goes to the Vertex eu endpoint. Google's data-residency terms still exclude Web Grounding for Enterprise from EU data-residency / ML-processing commitments, even when the organisation has require_eu_inference. Google states the service does not log or store customer data. Query text for an Exa-configured org leaves Google's Vertex path for that tool call.

Per Google's Vertex AI terms, as documented in our own product terms, customer prompts and model outputs used for chat/embeddings are not used to train Google's models. Prompts include only the project and organization context that the requesting user already has access to.

Subprocessors

  • Supabase (Stockholm) — Postgres database, authentication, and file storage.
  • Google Cloud — Cloud Run in europe-west1, plus Vertex AI for chat and embeddings.
  • Exa — Optional platform web search via hosted MCP when the organisation's provider is Exa.
  • Google Cloud Vertex AI — Web Grounding for Enterprise — Optional platform web search on the Vertex EU MLP (aiplatform.eu.rep.googleapis.com) when the organisation's provider is Google. Google's data-residency terms still exclude this product.

Operational practices

  • Code changes go through pull-request review before being deployed to production.
  • Database migrations are versioned, append-only, and reviewed alongside the code change that depends on them.
  • Production secrets are managed in our hosting platform's environment store and are not committed to source control.
  • Logs and metrics are retained only as long as needed to operate and debug the service.

Reporting a vulnerability

If you believe you have found a security vulnerability in Valora, please email herman@vardenlab.com. We appreciate disclosure that gives us a reasonable window to investigate and resolve the issue before it is shared publicly.