Security-ready architecture

• All data encrypted in transit (TLS 1.2+) and at rest by the managed backend.
• Row-level security on user-data tables — a veteran can only read or write their own records.
• Role-based access stored in a separate roles table (never on the user profile).
• Anonymous-by-default identity: call signs (e.g. vet-sierra-6), no real name required.

Privileged actions by org admins, peer specialists, and operations are written to an append-only audit log with actor, action, target record, and timestamp. Records are reviewable in-app and exportable for operator and funder reporting.

• High-risk check-in flags route to a documented handoff path: peer, on-call contact, or the 988 Veterans Crisis Line (press 1).
• Crisis events are written to a dedicated table for clinical and funder review.
• Means-safety prompts are logged separately.
• Valor is not emergency care. 988 and 911 are always one tap away in-app.
• Clinical governance of these flows is a required institutional responsibility post-transfer.

The shell is architected with HIPAA-aligned technical safeguards in mind — access controls, audit controls, integrity controls, transmission security. A formal HIPAA program — risk assessment, policies, training, BAAs with subprocessors, and ongoing review — is institutional work the acquiring operator must complete. Valor does not currently operate as a HIPAA-covered entity.

• Veterans can request full account and data deletion from their profile.
• Aggregated, anonymized program metrics may be retained for outcomes reporting.
• No personal data is sold or shared with advertisers.

Valor uses a small set of infrastructure providers for hosting, database, edge compute, and transactional email. A current subprocessor list is available to qualified institutions under NDA during diligence.

• Independent security review and penetration test.
• SOC 2 Type I, then Type II audit.
• Formal HIPAA program with executed BAAs.
• Licensed clinical leadership and on-call protocols.
• Independent third-party outcomes evaluation.
• 24/7 engineering on-call ownership.

Valor does not currently hold a SOC 2, HITRUST, HIPAA, or FedRAMP certification.

For vulnerability reports or institutional diligence requests, contact security@valor4vets.org.