This page is written for IT and compliance teams reviewing ValixData as a vendor. We've tried to be honest about what exists now and what is on our roadmap — because a vendor who overstates their security posture is worse than no vendor at all.
Where we are today. We don't claim certifications we don't have.
What is implemented and verifiable today.
Our path to Type II certification. Updated quarterly.
If your firm requires SOC 2 before onboarding, we can provide current control documentation, a security questionnaire response, and a pre-audit readiness summary under NDA. Use the IT review request form below.
The compliance question that matters most to regulated firms.
Documents we can provide for a vendor assessment review.
Our standard DPA governing how ValixData processes data on behalf of your firm. Covers sub-processors, data subject rights, breach notification, and GDPR/CCPA compliance terms. Enterprise clients can negotiate custom DPA terms.
Request DPA →Pre-filled responses to the CAIQ (Cloud Security Alliance Consensus Assessment Initiative Questionnaire) and standard vendor security questionnaires. Covers data handling, access controls, incident response, business continuity, and sub-processor inventory.
Request questionnaire →A complete list of third-party processors that may handle user data on ValixData's behalf — including Anthropic (AI processing), Stripe (billing), and our hosting infrastructure provider. Current as of this page's last update.
Request sub-processor list →If your firm needs a formal vendor assessment before approving ValixData, start here. We'll respond within two business days.
We respond to all IT review requests within two business days. Complex enterprise reviews may require an NDA prior to sharing detailed documentation.