/* VALDEX — Trust & security */

const UPDATED_TR = "May 18, 2026";

function TrustPage() {
  return (
    <LegalShell
      title="Trust & security"
      updated={UPDATED_TR}
      intro={
        <React.Fragment>
          <p>
            This page describes how <strong>VALDEX LLC</strong> protects the data clients
            entrust to us during an engagement — the credentials, analytics access,
            customer lists, and content we touch when doing the work. It is written for
            buyers doing vendor due diligence and for our own engineers, so it has the
            specific details on both sides.
          </p>
          <p>
            We are a small firm. We are not SOC 2 certified at the time of this writing.
            We don't pretend otherwise. The trade we offer is small-team rigor and
            transparency rather than auditor-stamped paperwork. The section on{" "}
            <a href="#roadmap">roadmap</a> describes where we are heading.
          </p>
        </React.Fragment>
      }
      sections={[
        { id: "summary", h: "1. At a glance", body: (
          <React.Fragment>
            <table className="legal-table">
              <thead>
                <tr><th>Control area</th><th>Current state</th></tr>
              </thead>
              <tbody>
                <tr><td>Transport encryption</td><td>HTTPS/TLS 1.2+ everywhere; HSTS enabled on valdexai.com</td></tr>
                <tr><td>Data at rest</td><td>Provider-level AES-256 (Google Workspace, Stripe, 1Password); no self-hosted database holds personal data</td></tr>
                <tr><td>Identity &amp; access</td><td>SSO via Google Workspace; mandatory hardware-key (YubiKey) second factor for every employee; quarterly access reviews</td></tr>
                <tr><td>Credentials</td><td>1Password Business; no shared logins; client credentials siloed per engagement</td></tr>
                <tr><td>Endpoint security</td><td>Full-disk encryption, automatic OS updates, screen lock, malware protection on every workstation</td></tr>
                <tr><td>Vendor / subprocessor management</td><td>Written subprocessor list at <a href="/subprocessors">/subprocessors</a>; new vendors reviewed against this policy before onboarding</td></tr>
                <tr><td>Logging &amp; monitoring</td><td>Server logs 30 days; access to client workspaces audited via Google Workspace admin logs (retained per Google policy)</td></tr>
                <tr><td>Incident response</td><td>Documented runbook (Section 5); 72-hour regulator notification commitment; client notification without undue delay</td></tr>
                <tr><td>Backups</td><td>Provider-native (Google Workspace, Stripe). Engagement workspaces are reproducible from source; we do not keep separate backup copies of client data outside the workspace</td></tr>
                <tr><td>Business continuity</td><td>Three named principals; documented operating runbook; no single-point-of-failure dependencies for active engagements</td></tr>
                <tr><td>Certifications</td><td>None at this time. SOC 2 Type I scheduled for Q1 2027 (see roadmap)</td></tr>
              </tbody>
            </table>
          </React.Fragment>
        )},
        { id: "encryption", h: "2. Encryption", body: (
          <React.Fragment>
            <h3>In transit</h3>
            <p>
              All traffic to valdexai.com is HTTPS. We enforce TLS 1.2 minimum (most
              connections negotiate TLS 1.3), modern cipher suites, and HSTS with a
              one-year max-age. The site scores A+ on Qualys SSL Labs at the time of this
              revision.
            </p>
            <p>
              Communication with client systems (analytics platforms, ad accounts, CMS
              instances) is HTTPS by default; we do not transit unencrypted connections.
              Email between Valdex and clients is encrypted in transit when both sides
              support TLS (the standard for Google Workspace ↔ Google Workspace, Office
              365, and most modern providers).
            </p>
            <h3>At rest</h3>
            <p>
              Client data lives in Google Workspace (Drive, Gmail, Calendar) and the
              specific platforms a client has authorized us to access. Each of these
              providers encrypts data at rest with AES-256 or equivalent. We do not run
              our own database that holds personal data.
            </p>
            <p>
              Credentials are stored in <strong>1Password Business</strong> with end-to-end
              encryption. The secret key never leaves the user's device unencrypted.
            </p>
            <h3>Key management</h3>
            <p>
              We rely on our providers' managed key infrastructure. Where customer-managed
              encryption keys (CMEK) are available and a client requires them, we will
              configure them — at the client's cost.
            </p>
          </React.Fragment>
        )},
        { id: "access", h: "3. Identity, access, and personnel", body: (
          <React.Fragment>
            <h3>Identity</h3>
            <p>
              Every employee account is provisioned through Google Workspace and protected
              by a hardware security key (YubiKey 5) as the second factor. We do not use
              SMS as a 2FA factor. We disallow personal device sign-in unless that device
              is enrolled in our endpoint management profile.
            </p>
            <h3>Least privilege</h3>
            <p>
              Access to a client workspace, ad account, or analytics property is granted
              only to the engagement principals working on that client and is removed on
              termination or role change. We do not maintain "global admin" access to any
              client system we don't actively use that week.
            </p>
            <h3>Personnel</h3>
            <p>
              At the time of this revision we are three principals plus a small number of
              contractors engaged for specific deliverables. All personnel sign a
              confidentiality and IP-assignment agreement before access is granted.
              Contractors are bound by an NDA at least as strict as the one in our{" "}
              <a href="/terms">terms of engagement</a>, §8 (confidentiality). Background
              checks are not yet a documented process; we will adopt one before we exceed
              ten people.
            </p>
            <h3>Termination</h3>
            <p>
              On a personnel departure, all access (Workspace, 1Password vaults, client
              platforms) is revoked the same day. Departing personnel hand back any
              hardware, and any shared credentials they had access to are rotated within
              48 hours.
            </p>
          </React.Fragment>
        )},
        { id: "data", h: "4. Data handling during engagements", body: (
          <React.Fragment>
            <h3>Where client data lives</h3>
            <p>
              An engagement workspace is a folder inside our Google Workspace, scoped to
              the principals on the engagement. It contains the engagement charter,
              status notes, deliverables, and any data the client has shared with us
              (audience exports, content drafts, analytics extracts).
            </p>
            <p>
              We do not retain copies of client data on personal devices, in personal
              email, in personal cloud accounts, in any AI training pipeline, or in any
              system outside the engagement workspace.
            </p>
            <h3>What we do not do with client data</h3>
            <ul>
              <li>We do not use client data to train models — ours, our clients', or anyone else's.</li>
              <li>We do not sell or share client data with any third party.</li>
              <li>We do not use client data for our own marketing without written approval (see <a href="/terms">terms</a> §11).</li>
              <li>We do not retain client data outside the contractual records required by tax and contract law (see <a href="/privacy">privacy notice</a> §6).</li>
            </ul>
            <h3>Deletion on termination</h3>
            <p>
              Within 30 days of an engagement ending, we delete the engagement workspace,
              remove our access to all client systems, and confirm deletion in writing.
              Records that must be retained for legal or tax reasons (signed contracts,
              invoices) are kept for 7 years and then irrecoverably deleted.
            </p>
          </React.Fragment>
        )},
        { id: "incident", h: "5. Incident response", body: (
          <React.Fragment>
            <p>
              We maintain an internal incident-response runbook covering detection,
              containment, eradication, notification, and post-mortem. The runbook is
              reviewed annually and after every exercise or real event.
            </p>
            <h3>Notification commitments</h3>
            <ul>
              <li><strong>Affected clients:</strong> notified <strong>without undue delay</strong> after we confirm an incident affects their data, and in any case within <strong>72 hours</strong>. We will share what we know, what we don't know, and what we are doing.</li>
              <li><strong>EU/UK regulators:</strong> where GDPR Article 33 applies (we are a processor for the client), we notify the controller without undue delay so they can meet their 72-hour obligation.</li>
              <li><strong>California residents:</strong> notification per Cal. Civ. Code § 1798.82.</li>
              <li><strong>Other state regulators:</strong> we follow the strictest applicable state breach-notification law where multiple apply.</li>
            </ul>
            <h3>What "incident" means here</h3>
            <p>
              An incident is any confirmed or reasonably suspected event that compromises
              the confidentiality, integrity, or availability of client data — an
              unauthorized access, a misconfigured share, a lost or stolen device, a
              compromised credential, a vendor breach affecting us, a successful phishing
              attempt against an employee with access to client systems. We treat near-
              misses as learning events even when they do not trigger notification.
            </p>
            <h3>Reporting an incident to us</h3>
            <p>
              If you believe you've discovered a security issue with this site or with our
              practice, email{" "}
              <a href="mailto:security@valdexai.com">security@valdexai.com</a>. We
              acknowledge within 1 business day and will keep you updated through
              resolution. Section 8 below describes our vulnerability-disclosure
              expectations and safe-harbor.
            </p>
          </React.Fragment>
        )},
        { id: "vendors", h: "6. Subprocessors and vendor risk", body: (
          <p>
            The current list of subprocessors — the providers we use to run the business —
            lives at <a href="/subprocessors">/subprocessors</a>. Adding a new
            subprocessor requires the same review as our initial vendor onboarding:
            evidence of security practice (SOC 2, ISO 27001, or equivalent), a written
            data-protection agreement, and a risk note in our vendor log. Clients are
            notified at least <strong>30 days</strong> before a new subprocessor that
            processes their personal data is engaged, with an opportunity to object.
          </p>
        )},
        { id: "businesscont", h: "7. Business continuity", body: (
          <React.Fragment>
            <p>
              We are a small firm with no single-server, single-database, or
              single-employee dependencies for active engagements. The risk profile that
              matters here is: the unavailability of a principal.
            </p>
            <ul>
              <li>Every engagement has at least two named principals with active context.</li>
              <li>Every status note, deliverable, and account credential lives in the engagement workspace, not in any one person's head or laptop.</li>
              <li>The runbook for re-establishing access to a client system in a principal's absence is documented and tested annually.</li>
              <li>If both engagement principals become unavailable, the managing principal can pick the engagement up within 5 business days using the engagement workspace alone.</li>
            </ul>
          </React.Fragment>
        )},
        { id: "vulndisclosure", h: "8. Vulnerability disclosure", body: (
          <React.Fragment>
            <p>
              If you discover a security vulnerability affecting our website or
              infrastructure, we want to hear about it. We commit to:
            </p>
            <ul>
              <li>Acknowledging your report within <strong>1 business day</strong>.</li>
              <li>Triaging and providing a substantive response within <strong>10 business days</strong>.</li>
              <li>Not pursuing legal action against good-faith security research that respects the rules of engagement below.</li>
              <li>Crediting researchers in our disclosure post if they want credit.</li>
            </ul>
            <h3>Rules of engagement (safe-harbor)</h3>
            <p>You may, in good-faith research:</p>
            <ul>
              <li>Test against your own accounts or accounts you have explicit permission to test.</li>
              <li>Probe for vulnerabilities at a rate that does not degrade service for other users.</li>
              <li>Demonstrate proof-of-concept without exfiltrating data beyond what is strictly necessary.</li>
            </ul>
            <p>You may not:</p>
            <ul>
              <li>Access, modify, or destroy data that does not belong to you.</li>
              <li>Run automated scanners that materially degrade service.</li>
              <li>Use social engineering against employees or contractors.</li>
              <li>Engage in physical-security testing of our office or staff.</li>
              <li>Disclose a vulnerability publicly before we have had a reasonable opportunity to fix it (we coordinate a disclosure window, typically 90 days).</li>
            </ul>
            <p>
              Report to <a href="mailto:security@valdexai.com">security@valdexai.com</a>.
              Encrypt sensitive details if you can; ask for our PGP key in your first
              message and we will reply with it.
            </p>
          </React.Fragment>
        )},
        { id: "dataretention", h: "9. Data retention", body: (
          <p>
            Specific retention periods are described in the{" "}
            <a href="/privacy">privacy notice</a> §6 (for personal data we process as a
            controller) and the <a href="/dpa">DPA</a> (for personal data we process on
            behalf of a client).
          </p>
        )},
        { id: "compliance", h: "10. Compliance posture", body: (
          <React.Fragment>
            <ul>
              <li><strong>GDPR / UK GDPR:</strong> structurally aligned. See <a href="/privacy">privacy notice</a> and <a href="/dpa">DPA</a>.</li>
              <li><strong>CCPA / CPRA:</strong> structurally aligned. We do not sell or share personal information; California rights honored at the same standard as everyone else.</li>
              <li><strong>HIPAA:</strong> we do not knowingly process Protected Health Information and do not enter into Business Associate Agreements. Clients in regulated healthcare should anonymize before sharing.</li>
              <li><strong>PCI-DSS:</strong> out of scope. Payment processing is offloaded to Stripe (PCI DSS Level 1). We never see or store card numbers.</li>
              <li><strong>SOC 2:</strong> not yet certified. Type I targeted for Q1 2027.</li>
              <li><strong>ISO 27001:</strong> not yet certified. Re-evaluated alongside SOC 2.</li>
            </ul>
          </React.Fragment>
        )},
        { id: "roadmap", h: "11. Roadmap", body: (
          <React.Fragment>
            <p>What we know is missing today and when we plan to address it:</p>
            <ul>
              <li><strong>External penetration test</strong> of valdexai.com (Q3 2026).</li>
              <li><strong>Documented background-check policy</strong> for employees and contractors (Q3 2026).</li>
              <li><strong>SOC 2 Type I readiness</strong> — engaging an auditor (Q4 2026); Type I report (Q1 2027); Type II in scope after 6 months of evidence.</li>
              <li><strong>Formal accessibility audit</strong> of the website (Q4 2026).</li>
              <li><strong>Customer-managed encryption keys (CMEK)</strong> support for the engagement workspace where a client requires it (on demand).</li>
            </ul>
            <p>
              Buyers who want a security questionnaire answered should email{" "}
              <a href="mailto:security@valdexai.com">security@valdexai.com</a>. We will
              respond honestly, including where the answer is "not yet."
            </p>
          </React.Fragment>
        )},
        { id: "contact", h: "12. Contact", body: (
          <React.Fragment>
            <p>
              <strong>VALDEX LLC</strong><br />
              Attn: Security<br />
              1309 Coffeen Ave, Ste 1200<br />
              Sheridan, WY 82801, United States<br />
              <a href="mailto:security@valdexai.com">security@valdexai.com</a> · (762) 760-1179
            </p>
          </React.Fragment>
        )},
      ]}
    />
  );
}

ReactDOM.createRoot(document.getElementById("root")).render(<TrustPage />);