Compliance

This page covers privacy law, where data is kept, and the documents a security review asks for.

Privacy laws

Vallkey is designed so that it can’t read the data that matters most: your vault. What it does process, and why, is in the privacy policy.

GDPR and UK GDPR. For a business, Vallkey is a processor of its members’ account data, under the data processing agreement. Vault contents are processed only as ciphertext.
Data residency. Vallkey Cloud has separate regions in the United States and the European Union. An account stays in the region chosen at sign-up, backups included.
Your rights. Anyone can export their whole vault, and delete their account with everything in it, from the apps themselves, without asking us.
Transfers. Where personal data leaves the EEA, transfers rely on the European Commission’s Standard Contractual Clauses.

Independent reviews. Every report is published on the Audits page, in full. Vallkey names a certification here only once its report is issued.
Responsible disclosure. Anyone can report a vulnerability under the disclosure policy, with safe harbor for research in good faith.
Accessibility. This website meets WCAG 2.2 AA, checked on every build. See the accessibility statement.

Three properties of the design do most of the work in a review:

We can’t read vaults. There is no vault content to disclose, mishandle or hand over.
Every audit is published. Each independent review’s report, with every finding and how it was fixed, goes on the Audits page unedited.
You can run it yourself. The same server runs Vallkey Cloud and self-hosted installs, so a company that must keep data on its own systems can.

Security review answers: what a vendor assessment asks, answered section by section.
The trust center, for what our servers can and can’t see.
The data processing agreement and the subprocessors.

For a filled-in CAIQ or SIG Lite, write to sales@vallkey.com.

Last updated October 5, 2026