Security and Confidentiality Disclosure

Client information must be accessed only by authorized people who need it for assigned work. Personnel and contractors handling it must follow applicable confidentiality commitments, client instructions, and approved access procedures. Access should be adjusted or removed when the business need ends.

Client credentials and records must not be shared outside approved channels or used for personal purposes. Client information must not be copied to personal accounts, unapproved storage, or public AI tools without appropriate authorization. Written confidentiality or data-processing terms can be agreed as part of an engagement.

Appropriate administrative, technical, and physical safeguards must be selected for the sensitivity and risks of the work. The agreed arrangements should address account permissions, authentication, secure transfer and storage, device protection, retention, incident reporting, and personnel responsibilities.

This page does not assert that a particular encryption standard, multifactor authentication setting, monitoring service, audit, hosting location, or certification applies to every system. Clients can request an accurate description of the controls relevant to their engagement before sharing information. Any specific control or certification claim must be supported by current evidence and its stated scope.

When work takes place in client-controlled systems, responsibilities for accounts, permissions, configuration, and data retention should be documented. Each party remains responsible for its own legal and contractual obligations. A client's permission does not override a platform's access rules or applicable law.

Any subcontractor or technology provider permitted to handle client information must be assessed for the intended use and subject to appropriate confidentiality, security, and data-use restrictions. Required client approval must be obtained before access is granted.

Report a suspected unauthorized disclosure, suspicious message, or vulnerability to complaints@virtualvalleys.com with the subject "Security concern". Provide a short description, the affected service, and relevant dates. Avoid sending passwords, live customer records, or unnecessary sensitive information in the initial report.

Our response must include appropriate assessment, containment, preservation of relevant evidence, and coordination with affected clients or providers. Notifications to clients, individuals, or authorities must follow applicable law and contractual obligations. This disclosure does not replace a client's incident-notification requirements.

Submitting a vulnerability report does not authorize access to another person's information, disruption of services, or testing beyond permission already granted. Ask for written authorization before conducting active testing.

No internet service or security measure can eliminate every risk. We do not promise that systems are invulnerable or that an incident can never occur. This statement does not exclude responsibility that cannot lawfully be excluded or reduce obligations under an applicable agreement.