Security & Trust

valta-web (this site) is a content site with no database or login system of its own — the only real write point is the contact form. The "My area" link goes to valta-platform, Valta's private platform, which has its own architecture, database and authentication, entirely separate from this site. Keeping the public site's attack surface this small is itself a deliberate security choice, not an oversight.

This site holds no business data of any kind — no client records, no operational figures beyond what's published as marketing content. valta-platform (where real company data, roles and licensing live) is a fully separate application, repository and database; nothing typed into this site's contact form or voice assistant ever reaches it.

This public site has no login system of its own — the "My area" link is a bridge into valta-platform's own authentication. The floating voice assistant is protected by a shared access code, checked with a constant-time comparison, after which a signed httpOnly cookie is issued (30 days) — access can't be forged by manipulating the browser alone.

Not applicable on this public site, which has no user accounts to assign roles to. Role-based access control (by area, AI agent and pipeline) is a valta-platform concern — see that product's own documentation, not this marketing site.

The contact form endpoint enforces rate limiting to slow down abuse, and its logs record only metadata (timestamp, delivery status) — never the full message content, precisely so an incident review never exposes what a visitor actually wrote.

All traffic to this site is served over HTTPS/TLS by our hosting provider. Because the site persists no business database, there is no "encryption at rest" surface to speak of beyond the platform-level protections our hosting provider already applies to its infrastructure — we don't claim more than that.

Providers used by this site: our hosting (Vercel), an email provider for the contact form, and Anthropic (Claude) for the voice assistant. Access to those services is managed securely and never publicly exposed. If a submission fails, no technical detail appears in the response.

Providers used by this site: our hosting (Vercel), an email provider for the contact form, and Anthropic (Claude) for the voice assistant. Access to those services is managed securely and never publicly exposed. If a submission fails, no technical detail appears in the response.

This site exposes two write endpoints: the contact form and the voice assistant. Both validate every request server-side with Zod (never trusting the browser alone) and enforce rate limiting. Known limitation, stated plainly: today's rate limiting is in-memory, which is not fully reliable across multiple serverless instances — if abuse volume ever justifies it, the plan is to move to a distributed rate limiter.

The floating voice assistant (built on Claude) is purely informational: its system prompt explicitly forbids it from inventing business figures or asserting unconfirmed legal/corporate claims, and it can only suggest navigating to real pages on this site — it never accesses real Evola, Fluxa or Sovra data, and never takes any action on a visitor's behalf.

Every contact form submission is reviewed and answered by a person — the assistant and the form are informational and intake channels, not decision-makers. Nothing on this public site executes a business action automatically.

Providers used by this site: our hosting (Vercel), an email provider for the contact form, and Anthropic (Claude) for the voice assistant. Access to those services is managed securely and never publicly exposed. If a submission fails, no technical detail appears in the response.

What personal data this site processes (contact form, voice assistant session cookie) and why is documented in full in our Privacy Policy — this page covers security controls, that page covers data rights.

If you find a vulnerability or have a security question, reach us through our contact form — we'll respond directly.