How we keep your data safe.
ValiqAI tests websites, so you trust us with access to yours. Here’s exactly how we protect your account and your scan data, including what we don’t have yet.
Last updated September 29, 2026
Security at a glance
- Traffic
- HTTPS only
- Stored data
- Encrypted at rest
- Passwords
- Hashed with bcrypt
- Scan files
- Private, links expire in an hour
- Your results
- Only your team can see them
- Scans
- Only on domains you’ve verified
- Card details
- Never stored
- Selling your data
- Never
- SOC 2 report
- Not yet
- Two-factor login
- Coming soon
Your data
Encrypted, private, and only seen by your team.
Encrypted everywhere
All traffic uses HTTPS (TLS). Our database, backups, and scan files are encrypted at rest by the providers that host them.
Private scan files
Screenshots and videos are stored privately. When you open one, the app creates a link that stops working after an hour.
Only your team
Your scans and results are only visible to you and the members of your team.
When we look at it
Only to run and support the service, keep it secure, or follow the law, or when you ask us to, like for a support request.
Your account
Safe ways to sign in, and what’s still coming.
Passwords
Hashed with bcrypt before they’re stored. We never keep them as plain text.
Google and GitHub sign-in
Sign in with an account you already use instead of a new password.
Single sign-on
Enterprise teams can use SAML or OIDC. Single sign-on secrets are encrypted before they’re stored.
Two-factor authenticationNot yet
Not available yet. It’s coming soon.
Testing sites safely
Only sites you’re allowed to test, and gently.
You prove you own the domain
Before a scan runs, you add a DNS record to prove you own the domain. This applies however you start it: the app, the API, or Slack. Scans of domains you haven’t verified are blocked.
Gentle on your site
Security checks send a small, fixed number of requests. For example, a login check tries at most ten times.
Hard time limits
Every scan has hard time limits, so a run can’t go on forever or overload your site.
Only test what you’re allowed to
Only test sites you own or have permission to test, and use a staging site when you can.
Keeping and deleting data
You stay in control. Full details are in our Privacy Policy.
While your account is active
We keep your data so you can look back at past scans. Scan files may be removed over time.
Delete your account
From Settings, at any time. This removes your account and its data.
Delete specific scans
Email abhi@valiqai.com and we’ll delete them for you.
Backups
Deleted data is removed from our live systems and ages out of encrypted backups on our normal backup cycle.
How we build
Checks on every change we make.
Secret scanning
Every code change is checked for accidentally committed passwords and keys.
Code scanning
Every change is also scanned for common security issues.
Safe database queries
The app validates what you send it and uses parameterized queries, which guard against injection attacks.
Keys stay out of our code
Passwords and API keys live in secure environment settings, never in the code itself.
Also good to know
Who else is involved, and what happens if something goes wrong.
Services we use
A small set of trusted providers, each bound by data processing terms. AI providers get the pages and screenshots from the site you test, never your ValiqAI password or payment details. See the full list.
If something goes wrong
If an incident affects your personal data, we’ll investigate, fix it, and tell you and any authorities as required by law and our DPA.
Connected apps
When you connect Slack or Jira, the keys that let ValiqAI post to them are encrypted before they’re stored.
Your part
Keep your login private and use a strong, unique password. If you think your account was compromised, email us right away.
Security questions
Not yet. If you need to complete a security review, email us and we’ll answer your questionnaire directly.
Not yet. It’s coming soon.
Yes. SAML and OIDC single sign-on is available for Enterprise teams. Email us to set it up.
We support GDPR and CCPA rights as described in our Privacy Policy, and we offer a Data Processing Agreement.
Mostly in the United States. Each service we use, and where it runs, is on our Subprocessors page.
No. Anthropic and OpenAI don’t use data sent through their APIs to train their models.
Reporting a vulnerability
Found a security issue in ValiqAI? Please tell us privately so we can fix it before anyone else finds it.
Email abhi@valiqai.comHow to report
Tell us what you found, the steps to reproduce it, and any details that help (the URL, the request and response, screenshots). Please give us reasonable time to fix it before you share it publicly.
Please do
- Report issues promptly and in good faith
- Give us enough detail to reproduce the issue
- Use only test accounts and your own data
- Give us reasonable time to fix it before you disclose it
Please don’t
- Access, change, or delete data that isn’t yours
- Run denial-of-service or high-volume automated attacks
- Share the issue publicly before we’ve had a chance to fix it
- Use social engineering, phishing, or physical attacks
We won’t take legal action against researchers who act in good faith and follow this policy. We don’t run a paid bug bounty yet, but we’re grateful for every report and will credit you if you’d like.