Security & Responsible AI

1. Security Principles

• Least-privilege access for people and systems.
• Encryption of data in transit using industry-standard TLS.
• Segregation between client environments.
• Multi-factor authentication on all critical systems.
• Continuous review of dependencies and configurations.

2. Confidentiality

Every Valora practitioner is bound by written confidentiality obligations. Client information is accessed strictly on a need-to-know basis and only for the purpose of the engagement.

3. Secure Delivery Lifecycle

• Security requirements captured alongside functional requirements.
• Static analysis and dependency scanning in the delivery pipeline.
• Secrets management and injection-risk detection.
• Peer review before release.

4. Responsible AI

• Human oversight of AI-assisted outputs.
• No use of client data to train foundation models.
• Selection of AI providers with strong data-handling commitments.
• Alignment with emerging regulation, including the EU AI Act.

5. Incident Response

We maintain internal procedures to identify, contain and communicate about security incidents affecting client data. Clients are notified promptly of incidents that materially affect them, in line with contractual and legal obligations.

6. Reporting a Concern

If you believe you have identified a security vulnerability affecting Valora Outcomes, please contact privacy@valoraoutcomes.pl. We appreciate responsible disclosure and will acknowledge legitimate reports.

7. Compliance Posture

Valora Outcomes designs its practices to support clients operating under regulations such as GDPR, DORA and NIS2. Independent certifications are pursued in line with client and market requirements; current status is available under NDA.