HOME / SECURITY AND DATA
Security and data
Last updated 19 August 2026
This page states what is true today, including the things buyers usually hope to hear and we cannot say. ValueRamp has no SOC 2 report and no ISO 27001 certification, and the section near the bottom lists what else is missing. If a security page never tells you what a vendor lacks, it is not telling you much.
Where is ValueRamp data stored?
All data is stored in Supabase’s Singapore (ap-southeast-1) region. Regional data residency selection is not currently available.
That is the whole answer, and it applies to every customer — there is no per-workspace choice of region, and selecting one is not something the product offers. If your procurement requires data to stay in a specific jurisdiction other than Singapore, ValueRamp cannot meet that today.
Backups are stored separately, in Cloudflare R2 in the Asia-Pacific region. That is a different service and a different location from the database, and it is stated separately on purpose rather than folded into “Singapore”.
How is one customer’s data kept separate from another’s?
Every read and write is scoped to a single workspace by the backend, and the database refuses direct access from any client entirely.
There are four layers, and they do different amounts of the work:
| Layer | What it does |
|---|---|
| Session gate | Validates a real session on every request, with a signed role cookie. Session cookies are httpOnly, so page scripts cannot read them |
| Server-side proxy | The browser never talks to the database or the backend directly. Only an enumerated list of actions can be called, and identity is attached on the server — the client cannot supply its own role or workspace |
| Backend scoping — the real control | Every read is filtered by workspace and every scoped write carries a workspace ID. A role check runs at the top of each handler |
| Database backstop | Row-level security is enabled on every table with no policies at all, and the public API roles hold no privileges — so a leaked client key grants access to nothing |
Stated precisely because it is often described loosely: the isolation is enforced by the backend, and row-level security is a deny-all backstop rather than the mechanism that separates workspaces. Both are real; they are not the same thing.
What is recorded about changes to data?
Significant actions are written to an append-only audit log with the actor, the workspace and what changed.
Deletions in the product are soft deletes — records are archived rather than destroyed — which means an accidental removal is recoverable and an intentional one is visible. That is a deliberate trade: it favours recoverability and auditability over immediate erasure, and the limits it creates are covered below.
What happens to communication data?
Message content is held for a retention window you set between 7 and 90 days. The window is applied when a message arrives, so changing it does not apply to data already stored.
Two things about this are commonly assumed and are not true here, so they are stated plainly:
- Structured analysis is retained indefinitely. That includes the names and email addresses of participants. The retention window covers message content, not the analysis derived from it.
- Marking an account “do not analyze” stops AI analysis, not storage. Messages already received may remain in our ingestion records.
Communication Intelligence is off until a workspace administrator explicitly enables it. An optional consent acknowledgement is available in settings.
Who else processes ValueRamp data?
Twelve vendors, listed in full below. Eleven of them receive personal data.
| Sub-processor | Purpose | What it receives |
|---|---|---|
| Supabase | Primary database (Singapore) | All application data |
| Railway | Backend hosting | All backend data in transit and memory |
| Vercel | Frontend hosting | Rendered pages, session cookies, server logs |
| Cloudflare | Inbound email routing; document storage (R2) | Inbound email; uploaded PDFs |
| Resend | Outbound email | Recipient addresses and email bodies |
| Anthropic | AI analysis and drafting | Message bodies, transcripts, participant lists |
| HubSpot | CRM import (read-only) | Deals, companies, contacts, engagement history |
| Slack | Communication ingest | Channel and user info, message text |
| Calendar ingest; usage-data import | Calendar events; spreadsheet contents | |
| Fathom | Meeting transcripts | Full meeting transcripts |
| Sentry | Error monitoring — on our servers only | Exception details, stack traces, a sample of request traces |
| Frankfurter | Currency reference rates | Currency codes only — no personal data |
Sentry is listed deliberately: it is a sub-processor even though it is not a feature, and vendors like it are commonly left off lists like this for exactly that reason. It monitors errors on our servers only — the browser SDK ships in our code but is never initialised, so Sentry receives nothing from your browser.
What certifications does ValueRamp have?
None. ValueRamp has no SOC 2 report and no ISO 27001 certification.
Both are deferred until customers require them rather than pursued pre-emptively, and neither is in progress today. If your procurement process requires either, ValueRamp will not pass it, and no amount of conversation changes that — it is worth knowing before a demo rather than after one.
What else is missing?
A data processing agreement, self-serve data export, SSO, and enforced multi-factor authentication at our own boundary.
| Capability | Status |
|---|---|
| SOC 2 / ISO 27001 | Not held, not in progress |
| Data processing agreement (DPA) | Not available yet |
| Regional data residency choice | Not available — Singapore only |
| SSO / SAML | Not available. Google and Microsoft sign-in do work |
| Enforced MFA at our boundary | Not enforced by ValueRamp; your identity provider’s MFA applies if you use social sign-in |
| Self-serve data export or deletion | Handled manually — see below |
| Application-level encryption of message bodies | Not implemented |
ValueRamp also does not defend against a determined insider, and says so because the company is currently one person. Nor does it defend against nation-state actors or large-scale denial of service beyond what its hosting providers give it.
How do I request access to, or deletion of, my data?
Requests to access, correct, or delete personal data are handled manually. Contact arjun@valuerampai.com. We will respond as promptly as we are able.
There is deliberately no number attached to that sentence. Publishing a thirty-day commitment would require a process and a way of tracking it, and until both exist the commitment would be decoration. GDPR compliance is partial for the same reason: soft deletion exists, and a full deletion handler and DPA do not.
Common questions
Is ValueRamp GDPR compliant?
Partially, and not fully. Data is stored in Singapore, there is no data processing agreement available yet, and access and deletion requests are handled manually with no committed timescale. A DPA is required before ValueRamp can properly serve an EU customer, and it does not exist today.
Can I choose where my data is stored?
No. All data is stored in Supabase’s Singapore (ap-southeast-1) region and regional data residency selection is not currently available. Backups are held separately in Cloudflare R2 in the Asia-Pacific region.
Is my data used to train AI models?
ValueRamp does not train models on customer data. Message bodies, transcripts and participant lists are sent to Anthropic for analysis and drafting, as listed in the sub-processor table — that is processing, not training, and it is the reason Anthropic is named rather than described as “a hosting provider”.
What happens if I turn off Communication Intelligence?
Analysis stops. Messages already received may remain in our ingestion records, so turning it off is not the same as removing what was already collected — if you need that removed, ask, and it is handled manually.
Will ValueRamp get SOC 2?
When customers require it. It is not in progress today, and no date is promised.