Skip to content
ValueSync

Security

Your data, with clear rules.

Your invoices and contracts are confidential. This page describes how we handle them. The platform is in its pilot phase; these commitments are written into our contracts.

How data flows

Your data reaches the platform in an EU cloud region. Where documents need reading, they are sent to AI providers under terms that prohibit training models on customer data. Every result is reviewed by a consultant before it reaches you.

Your dataInvoices, ERP exports,contractsValueSync platformEU-hosted, encryptedAI providersNo training on customer dataConsultant reviewApproved with name and timeYouDashboard, ledger, exports

Hosting and encryption

  • An EU cloud region (Frankfurt, or Athens where available).
  • Encryption in transit and at rest, with per-client encryption keys for documents.
  • Daily encrypted backups and separate environments.
  • A dedicated instance option for larger clients.

Access and audit log

  • Microsoft or Google single sign-on, multi-factor authentication and role-based access.
  • A full audit log: every input, model version, output, reviewer and timestamp.
  • Penetration test before the first enterprise client. ISO 27001 roadmap from year two.

GDPR

  • For the content you entrust to us (invoices, contracts, contact details) we are processor. For our own account data we are controller.
  • A data-processing agreement (DPA), retention rules and a DPIA for the AI pipelines.
  • Your data is deleted within 30 days of the end of the engagement.
  • Sub-processor list available on request.

EU AI Act

  • The platform provides decision support on commercial matters, with human review. It makes no automated decisions with legal effects on natural persons.
  • Transparency: users can see where content was generated by AI and the evidence behind it.
  • Public-sector tender evaluation will require a separate compliance assessment before it is offered.

Models and AI providers

  • We use leading language models via API, under contract terms that prohibit training on customer data, with EU processing where the provider offers it.
  • Deterministic code wherever the logic is arithmetic: savings and fees are never calculated by a language model.
  • Every model or prompt change is evaluated against a Greek test set before release.

Confidentiality in tenders

  • Each bidder's data is segregated and evaluator access is logged.
  • Each bid is evaluated in isolation, so no information leaks between bidders.
  • We take no commissions or rebates from suppliers.

Security questions

For our DPA, the sub-processor list or a security questionnaire, write to hello@valuesync.gr.

hello@valuesync.gr