Vallkey

Legal

Data processing agreement

This agreement covers the personal data Vallkey processes for you when your apps and your team use Vallkey. It applies under the EU GDPR and UK GDPR, is part of the terms of service for the Business plan, and any customer can ask for a signed copy.

Last updated October 25, 2026

1. Who does what

You are the controller of the personal data in the requests your apps send through Vallkey. Vallkey is your processor: we process it only to provide Vallkey, following your instructions, which are this agreement, the terms of service and the settings you choose in the dashboard. For your own account details, such as your sign-in email, Vallkey is the controller, as the privacy policy explains.

2. The data

  • About your team: names and email addresses of the people on your account, and what they changed (the audit log).
  • About requests: for each request sent with a ghost key, its time, method, path, outcome, the caller's IP address and country, the client's user agent, and, for AI services, the model and token counts. When a browser sent it, the website it came from; for short-lived keys, the user id your server gave the key. Where you set limits for each visitor or user, request counts per IP address or user id, kept for up to two days.

Vallkey does not store the bodies of requests or answers. Real API keys are stored encrypted (AES-256-GCM) and are never shown again, exported or logged.

3. Why and for how long

Only to forward requests, enforce your rules, show you activity, send the alerts you ask for, and protect the service from abuse. Request history is kept for the time your plan shows (up to 90 days), the audit log for up to a year, and everything is deleted when you delete your account (see section 8).

4. Our duties

  • We process the data only on your instructions, and tell you if we think an instruction breaks the law.
  • Everyone who can reach the data is bound to keep it confidential.
  • We help you answer requests from people about their data, using the export and deletion tools in the dashboard, or by hand if needed.
  • We help with your data protection impact assessments and with questions from your regulator, as far as they concern Vallkey.

5. Security

Data is encrypted in transit (TLS) and at rest. Real keys are sealed with keys that only the service can open. Sign-in uses passkeys, authenticator apps or single sign-on, with a fresh check before dangerous actions. Access to production systems is limited to the few people who need it, and changes to your account are recorded in your audit log. The security page describes these measures in more detail.

6. Breaches

If a breach affects your data, we tell your account owner by email without undue delay, and at the latest within 48 hours of finding out, with what we know, what we are doing, and what you may need to do. We keep you updated until it is closed.

7. Who else handles the data

You allow Vallkey to use these sub-processors:

  • Our infrastructure provider runs Vallkey and stores its data.
  • Our email provider delivers sign-in codes and alerts, and receives the recipient's email address and the message.
  • Paddle.com, our merchant of record, handles payments and billing details. It does not receive request data.

Each one is bound by data protection terms at least as strict as these. We tell the account owner at least 30 days before adding or replacing one. If you object for a good reason and we cannot solve it, you may cancel and get back what you paid for the time not used. Ask for the current list with company names at any time.

8. Where the data is, and deletion

You choose a data region when you create the account. In the EU region, the data is stored and processed in the European Union. In the global region it is kept close to where Vallkey is used. Transfers outside the EU or UK are covered by the European Commission's Standard Contractual Clauses and the UK addendum.

When you delete your account, its data is deleted from the live service at once. Encrypted backups expire within 90 days. Before that, you can export your data from the dashboard.

9. Checks

We answer reasonable security questionnaires and give you the information you need to show that this agreement is followed. If that is not enough, you may ask for an audit once a year, with 30 days' notice, at your own cost, by an auditor bound to confidentiality.

10. A signed copy

Write to privacy@vallkey.com from your account email and we send you this agreement signed, with the Standard Contractual Clauses filled in.