Security and trust
ValueProof uses Vercel for the web application and Convex for its application database and functions. Provider safeguards and ValueProof application controls are described separately below.
Hosting provider safeguards
Vercel documents AES-256 encryption for data at rest on disk in its services and HTTPS/TLS 1.3 for data in transit. Convex documents AES-256 encryption at rest for customer data and TLS/SSH encryption for data in transit. These are provider safeguards for the services each platform controls; they do not mean ValueProof applies separate field-level or end-to-end encryption.
Current safeguards
Account users can enable authenticator-app MFA. Enrolled accounts verify a fresh code at each sign-in; unused one-time recovery codes are available if an authenticator is lost. Workspace owners can require MFA, and the application checks enrollment and session verification before allowing workspace data access.
Ledger queries check the signed-in user and workspace membership on the server. Workspace owners and admins can access that fund’s companies; portfolio company users can access only companies assigned to them.
Ledger write functions check workspace and company roles on the server. External viewers are read-only, and only the assigned portfolio company CFO can sign off on a value claim.
Ledger write functions append audit events with an actor and timestamp. The application exposes no update or delete function for those events; this is an application log, not an independently audited or tamper-proof archive.
ValueProof is a measurement tool and does not provide investment, audit, or accounting opinions.