Your Data, Protected
Encrypted Everywhere
Athlete data is encrypted in transit and at rest, and encryption keys are managed so that even our cloud provider cannot access them.
Isolated by Organization
Every organization's data is isolated from every other's, and access within your organization is scoped by role: admins, coaches, and athletes each see only what their role allows.
Hosted in the United States
Valor Vision runs on Amazon Web Services in the United States, infrastructure independently certified against SOC 2 and ISO 27001.
Least-Privilege Staff Access
Every employee passes a background check and signs confidentiality agreements. Access to customer data requires multi-factor authentication, is limited to the minimum needed, is logged, and is revoked (with company devices wiped) when someone leaves.
Your Data, Yours
You Own It
Your organization retains all rights, title, and interest in your data, through anything, including acquisition. You can export it at any time.
Never Sold
We have never sold personal information, and we commit to never selling it in the future.
Not Fuel for Outside AI
Your data is never shared with third parties or used to train any third-party or external AI model. De-identified, aggregated improvements happen only inside Valor-controlled environments, and your organization can opt out on request.
Delete Means Delete
Deletion requests are honored, and personal information is retained no longer than three months after an account is terminated.
AI That Measures, and Answers to Humans
Valor Vision's AI is a measurement instrument, not a content generator. Here is exactly what it does and doesn't do.
Measurements, Not Generation
Valor Vision is non-generative: it produces deterministic kinematic measurements (joint angles, ranges of motion, asymmetry flags) charted over your own footage. It is technically incapable of producing deepfakes or synthetic media.
We Don't Identify People
No biometric identification or verification, no emotion recognition, no categorization of sensitive attributes. The system measures movement, not identity.
Humans Make the Decisions
Every output is decision support for a qualified coach or clinician. The system makes no autonomous decisions about athletes, and administrators can suspend processing at any time.
Assessed Under the EU AI Act
Valor Vision is assessed as limited/minimal-risk under Regulation (EU) 2024/1689, with a documented AI Ethics Policy reviewed at least annually.
Optional AI Narration, on Your Terms
An optional narrative-summary feature uses a managed third-party language model. It receives only de-identified metrics (never footage or identities) and can be switched off for your organization.
Sub-Processor Discipline
Our sole hosting sub-processor is AWS. Adding any new sub-processor requires prior written customer authorization, and customer audit rights are supported.
Ready When Things Go Wrong
Incident Response, Around the Clock
A formal incident-response plan with 24×7×365 response capability, backed by cyber-risk insurance.
You Hear From Us Fast
If a breach affects your data, we notify you without undue delay, with the nature of the incident, what data was involved, and the corrective action underway.
Continuity, Rehearsed
Our business continuity plan is reviewed and tested annually.
Monitored Continuously
Access and activity across the platform are logged and monitored so anomalies surface early.
Our Compliance Posture, Honestly
We'd rather under-claim than over-claim. Here is exactly where we stand.
GDPR
We act as a processor under a Data Processing Agreement, with Standard Contractual Clauses covering international transfers, an explicit-consent legal basis, and enhanced protections for minors (13+).
CCPA
We operate as a service provider under the CCPA and honor California privacy rights, including deletion and do-not-sell.
FERPA
Student-athlete data is handled in a FERPA-compliant manner for higher-ed customers.
HIPAA
There is no official HIPAA certification, for us or anyone. Where a customer's use case involves protected health information, Valor operates as a business associate and enters into a Business Associate Agreement (BAA).
SOC 2
Valor runs on SOC 2- and ISO 27001-certified AWS infrastructure. Our own SOC 2 audit is on the roadmap; it will appear here when it's earned, not before.
Accessibility
A VPAT (Section 508 / WCAG 2.0 A & AA) is published for Valor Vision and available on request.
Running a Vendor Security Review?
We keep a current diligence set ready, the same artifacts we provide to professional clubs and universities:
- HECVAT Full v3.06
- VPAT 2.5 (Section 508 / WCAG 2.0 A & AA)
- Information Security Policy
- Business Continuity Plan
- AI Ethics Policy
- EU AI Act risk-classification memo
Security Questions, Answered
Where is athlete data hosted?
On Amazon Web Services in the United States, encrypted in transit and at rest, with every organization's data isolated from every other's.
Is athlete data used to train AI models?
Athlete data is never sold, never shared with third parties, and never used to train any third-party or external AI model. De-identified, aggregated data may be used to improve Valor's own models inside Valor-controlled environments, and customers can opt out of that on request.
Is Valor Vision generative AI?
No. Valor Vision is a non-generative measurement system: it produces deterministic kinematic metrics, charts, and overlays on your own footage, and is technically incapable of producing deepfakes or synthetic media. An optional narrative-summary feature uses a managed third-party language model that receives only de-identified metrics and can be disabled for your organization.
Is Valor SOC 2 certified?
Not yet. Valor Vision runs on SOC 2- and ISO 27001-certified AWS infrastructure, and Valor's own SOC 2 audit is on our roadmap. We publish only certifications we actually hold.
Does Valor support HIPAA?
There is no such thing as official HIPAA certification, for any vendor. Where a customer's use case involves protected health information, Valor operates as a business associate and enters into a Business Associate Agreement (BAA).
How do we run security diligence on Valor?
Email info@bravevirtual.com and we'll share our current diligence set: HECVAT Full v3.06, VPAT (Section 508 / WCAG 2.0 A & AA), Information Security Policy, Business Continuity Plan, AI Ethics Policy, and our EU AI Act risk-classification memo. Customer audit rights are supported.
See also our privacy principles and the privacy policy.
Questions Your Review Team Needs Answered?
Book a call and bring your security questionnaire. We'll work through it together.