Public trust center
This page describes the controls applied to the ValaisOS public website and early-access process. It deliberately does not make claims about an unreleased product.
Data discipline
Early-access records contain the information a visitor submits, a short first-party campaign label, consent choices, and delivery state. The application does not add an IP address, user agent, analytics identifier, or full referring URL to that record.
Transport and storage
The site is delivered over HTTPS with managed certificates and an HSTS policy. Intake data is stored in Azure Table Storage, which is encrypted at rest by Azure using Microsoft-managed keys.
Browser boundary
A restrictive Content Security Policy, frame protection, cross-origin isolation, locked browser permissions, same-origin APIs, and an explicit deployment allowlist reduce the public surface. No third-party analytics or advertising scripts are loaded.
Operational response
Regional availability checks run every five minutes. API failures and stale or failed email deliveries raise operational alerts. Every release must pass browser, performance, security, API, and live production checks.
The public site uses Microsoft Azure services. Microsoft maintains independent audit reports and certifications for specific services under programs such as SOC and ISO, but scope varies by service and report. Azure hosting does not make ValaisOS certified, and we do not present inherited cloud assurance as a ValaisOS compliance claim.
If you believe you have found a security issue affecting this public site, email hello@valaisos.com with “Security report” in the subject. Include the affected URL, a concise description, reproduction steps, and potential impact.
Please avoid accessing or changing information that is not yours, disrupting service, or using automated testing that could affect other visitors. We will acknowledge a credible report and coordinate next steps, but we do not currently operate a public bug-bounty program.
This Trust Center covers the public website, its early-access form, first-party aggregate measurement, and related notification operations. Product and private-preview controls will be documented separately before those environments accept participants or sensitive client information.