Security

Valinor has not yet signed a Business Associate Agreement, and our production environment holds no live patient health record today. Our staging environment runs on synthetic data only. We are building the controls before the data arrives rather than after, which is the order we think a health company owes its first design partner.

We are mid-programme for SOC 2 and HIPAA, managed in Secureframe with continuous control monitoring. We are not certified yet and we will not claim to be. When an audit is complete we will say so here, with the report available under NDA.

Every data store is encrypted at rest with a customer-managed key. That distinction matters: the key policy gates decryption independently of ordinary access permissions, so being granted read access to a store is not by itself enough to read what is in it.

Data in transit is TLS end to end. TLS terminates at our load balancer inside a private network, and traffic from there onward stays within that network. There is no unencrypted hop anywhere on the path.

A clinician can see a patient's record only where that patient has issued an explicit grant. Absence of a grant is a denial. There is no administrative override in the application — not for support, not for us.

Our production and staging accounts contain no long-lived user credentials at all. Staff access is federated and short-lived. Deployments authenticate through short-lived workload identity rather than stored keys, so there is no deployment secret to leak. Multi-factor authentication is enforced on production accounts.

Every read of clinical data passes through a single chokepoint that writes a FHIR AuditEvent. Those records are written to a separate, isolated account and held under object lock for seven years. They cannot be altered or deleted from the environment that produced them, including by us.

That is the point. An audit trail an operator can rewrite is not an audit trail, and a patient asking who looked at their record deserves an answer that cannot have been tidied.

Both services run as containers with a read-only filesystem, so a running process cannot modify its own code. Container images are immutable once published, scanned before they can be deployed, and every running revision maps to exactly one commit.

A web application firewall sits inline in front of the application. Network flow logging is on across every network we operate. Threat detection and configuration monitoring run continuously across all accounts, and availability alerts route to more than one person on more than one mail provider, so a mail outage cannot silence them.

Every data store has point-in-time recovery, and object storage is versioned, so an incorrect write can be reversed rather than merely regretted. We have tested restore rather than assumed it: a restore of FHIR resources was performed and verified byte-identical, and repeated against the production key.

If you believe you have found a vulnerability in Valinor, tell us through Contact us with enough detail to reproduce it. We will acknowledge you, work the issue, and tell you what we did. We will not pursue anyone who reports a genuine finding in good faith and does not access, modify or retain data that is not their own.

Doing diligence on us for a pilot? Get in touch and we will work through your questionnaire and share our current control evidence under NDA — including the parts that are still open.