For Valere’s partners, their IT and a procurement questionnaire

Security

What keeps Valere Group’s data safe in Valere CRM, in plain words: what it means for you, not how it is built. Every line comes from the project’s documents and carries one of three tags.

Done in the pilotThe pilot Apiko built already does this.In V1Committed for the first release, not built yet.Not promised yetNo document commits it; the last part says whom to ask.

Your data

Where it lives, who can reach it, how it is locked, how long it is kept, and how Valere takes it out.

Sources: N-05, N-07, N-08; D-033, D-038, D-040; S-02 §5–§8; S-03 §7, §8, INT-01; Decided outside; Staging; ADM-C16, C26, C43, C45–C49; EML-C01, C05

The path of a record: a person signs in, the CRM checks their role on every request, the data is locked on the way and where it rests, and every change goes to the audit log.

In V1
It stays in the UK or the EU
Hosting and processing are in the United Kingdom or the European Union, and so is the processing by the AI providers that read Valere’s records.
In V1
It sits in Valere’s own accounts
The code, the hosting, the database, the AI keys and the Microsoft connection are in accounts Valere owns from the first day, and the code, the pilot included, is assigned to Valere in full. Valere, not Apiko, holds the accounts.
In V1
Locked on the way and where it rests
Data is encrypted — scrambled so it cannot be read without the key — while it travels between the browser and the application, and again while it is stored.
In V1
Files stay in Valere’s SharePoint
Documents are not copied into the CRM. It keeps a link and a category, so a file stays where Valere’s own Microsoft 365 keeps it.
In V1
The Microsoft connection asks for as little as it can
One Microsoft connection, with the narrowest permissions that do the job, shown to Valere’s admin before consent. The admin can revoke them at any time: that stops mail, calendar, Teams and filing, never people signing in, and deletes nothing already logged or filed.
In V1
Personal email is never captured
Email is logged only for known Contacts and company domains, and at first sign-in each person is shown what is captured. Mail leaves from the person’s own mailbox through Microsoft, with no outside sending service.
In V1
The AI sees only what the person may see, and never learns from it
No Valere data is used to train AI models, and each AI provider works under a data processing agreement — the contract that limits what a supplier may do with the data. The AI runs on Valere’s own accounts; a person’s Claude or ChatGPT reaches the CRM only through an account Valere’s admin has enrolled.
In V1
Taken out in full, at any time
The admin can export every record and its history as a CSV file — a plain spreadsheet file — whenever Valere wants. The private Land log and the Land performance figures are left out unless a Partner / MD approves that one run, and each export is itself recorded.
In V1
One person’s data can be exported or erased on request
Everything held about one person is found across every record that holds personal data, and the file goes to the person or the requester without the admin seeing its content. Erasing blanks the personal values in place and leaves a marker, so the history stays whole; a one-way trace of an address that opted out remains, so that person is not contacted or collected again.
In V1
Kept as long as Valere decides
Valere sets the retention period — how long personal data is kept — in the product. When records fall due the admin is told, sees the list and a dry run of what would be erased, and runs it. No period is set yet; see the last part.
In V1
The test copy holds real data and sends nothing out
Valere tests every release on a staging copy with its real data; personal data is not hidden there, so the same retention and export rules apply to it. Emails, signatures, paid lookups, scheduled collection and AI spending are switched off or sandboxed, and the screen says it is staging.
In V1
Apiko’s own part is the installation
At installation Apiko creates the first Admin and the Microsoft connection, and both are recorded in the audit log. What Apiko’s engineers may reach in production afterwards is not written down yet; see the last part.

Who gets in

Accounts created only by the admin, what each of the six roles sees, how people sign in in the pilot and in V1, and how a leaver is closed out.

Sources: N-05, N-12; D-014, D-028, D-033, D-035, D-038, D-040; S-02 §6; S-03 INT-01; Roles and access; Access control; ADM-C01–C06, C11, C15, C23–C26, C50–C52, C55; EML-C01; the pilot’s ARCHITECTURE.md (sign-in and roles)

sees it and works in it sees part of it, or only reads it, as below does not see it

Back Office sees Leads and appraisals; Land sees its own Leads and region; Construction sees only Sites with Construction Involved = Yes.
The Admin works with settings, not with the Land log or Land performance: it reads the commission rates Partners / MD set, and sees the old and new values of the Land log masked in the audit log.
Partners / MD see everything; Land performance is never shown to staff.

Done in the pilot
Only people Valere adds get in
There is no public sign-up: the admin creates each colleague with a work email and a role, and nobody else creates users. The pilot works this way today, with a password the admin sets; in V1 the person signs in with their Microsoft account instead.
Done in the pilot
Every request is checked against the person’s role
The pilot decides by role who may move a Site to its next stage and who may edit which fields, shows a locked field with the function that owns it, and checks the role again on every request. V1 keeps this, with each role’s fields set by the admin.
In V1
Each role sees only its own scope
Construction sees only Sites with Construction Involved = Yes. The private Land log is for Land and the Partners / MD; Land performance is never shown to staff; commission rates are seen only by Partners / MD and the Admin. Search, the API and the AI assistant keep to the same limits.
In V1
Sign-in is Microsoft 365 with its second step, and nothing else
V1 retires the pilot’s password screens: the CRM keeps no password of its own and has no second way in. Microsoft asks for the second step — a code or an approval on the person’s phone — and that does not depend on the CRM’s own Microsoft connection. A Microsoft account with no CRM account is refused.
Done in the pilot
Today the pilot signs in with an email and a password; that ends in V1
That is the pilot’s honest state, and V1 removes it. The pilot keeps each password only in a one-way scrambled form that cannot be read back; a reset link works once and expires after 30 minutes; changing or resetting a password ends the session; a short sign-in pass renews itself once and signs the person out if that fails.
In V1
An unattended screen signs itself out
How long a session may sit unused is a setting of Valere’s admin, in whole minutes. The length is not set yet.
In V1
A leaver loses access at once
Deactivating a person stops their sign-in, revokes their tokens and starts the handover of their open work and duties to named successors; until one is named, the work goes to their named cover. Their name and history stay on every record.
In V1
The strongest role is handed out carefully
Only a Partner / MD can make someone an Admin, with a reason on the audit log, and two active Admins are always required so the product cannot lock itself. Duties such as MD, regional lead, finance partner and approver are assigned to named people; while the holder is away, the work goes to the deputy or a Partner / MD.
In V1
A tool gets a token that acts as its owner
Power BI, a person’s own Claude or ChatGPT, or a developer reads the CRM through the API — the documented way for another program to read it — with a token the person creates, with an expiry. The admin sees every token, can revoke any, and sets a limit on requests. A token never reaches beyond its owner.

Nothing is lost

Daily backups with a tested restore, history that is never overwritten, and what can be put back.

Sources: N-04, N-06; S-02 §5, §6; S-03 §1, §8, T26; Decided outside; Concurrency; Errors and recovery; ADM-C17, ACC-C06, D-034; the pilot’s ARCHITECTURE.md (removal)

In V1
Backed up every day, and the restore is tested
The Scope of Works requires daily backups with a tested restore, and the evidence of backups and restores is reported in the release notes. How far back the backups reach and when a restore is tested is Valere’s question T26, not answered yet; see the last part.
In V1
Available in working hours, 99.5% of the time
The target is 99.5% availability in working hours. Nothing is promised outside them; see the last part.
In V1
Every release can be taken back
Each deployment comes with release notes and can be rolled back to the version before it.
In V1
History is never overwritten
Records are versioned. Rejected Sites, offers and bids are kept, a slipped deadline keeps its original date, and a closed month’s figures do not move when live records change.
In V1
A closed Site stays on file
A Site closed as Dead stays on the record, and only the MD can reopen it, with a reason that is logged.
Done in the pilot
Removing is not erasing
The pilot marks a removed Account, Contact, Site or buyer or contractor link as removed instead of erasing it, and its history stays. V1 keeps the rule: an Account or a Contact is removed only after a confirmation and never erased, a merged duplicate keeps its history on the master, and a list value still in use is retired. The one deliberate exception is erasing a person’s data on request or at the end of retention.
In V1
Two people editing one record do not overwrite each other
The later save first shows the earlier change before it applies. The Monday meeting and the Weekly Regional Review are the cases it is tested on.
In V1
A changed setting can be put back
Every list, rate and threshold keeps its earlier values with who changed them and when. An earlier value is restored as a new change; the earlier entry stays.

Against attacks

Limits on tools, what is checked before anything changes, an AI that cannot act alone, and who can see what is running.

Sources: N-08, N-09, N-12; D-033, D-035; S-02 §5; S-03 §7, AUTO-03; Decided outside; AI assistance; Notifications; Errors and recovery; ADM-C24, C29–C32, C35, C36, C40, C43, C49, C55; the pilot’s ARCHITECTURE.md (stage moves)

Done in the pilot
An invalid change is refused, not quietly corrected
The pilot checks who is asking and whether their role may do it before anything changes, and refuses a stage move that breaks the rules instead of correcting it. V1 keeps the rule.
In V1
Tools are held back by limits
A token expires, and a request over the limit the admin set is refused until the limit renews. A revoked token is refused at once, and a deactivated person’s tokens are revoked with them.
In V1
Keys are kept protected, in Valere’s accounts
The admin enters the credentials for Adobe Sign, Creditsafe, Glenigan, Searchland, Lusha, BCIS and the AI provider, on Valere’s own licences, and they are held protected, as are the Microsoft connection’s settings.
In V1
The AI cannot act on its own
No stage is moved, no figure entered and nothing sent without a named approver. The appraisal, fee and KPI arithmetic is ordinary fixed code, never the AI. A document above the size the admin allows is shown as not read, never read in part.
In V1
An off switch and a spending cap for the AI
The admin can switch AI off, and the Partners / MD are told. A monthly spending cap per provider, with a warning below it, pauses scheduled AI jobs when reached; a draft a person asks for still runs. How exactly the cap behaves is provisional until Valere answers the open question.
In V1
Mail cannot go out by mistake
Automated email goes only to company contacts or to people who replied or agreed, with opt-out, a suppression list and a guard against sending twice; privately owned land is approached by letter or phone. The system never contacts outside parties except through outreach a person approved.
In V1
Permissions are tested on every release
Automated tests of calculations, permissions, handoffs and outreach rules run on every release, and Valere tests the result on staging before it goes live.
In V1
The admin can see what is running
A failed scheduled run or an unhealthy data source is shown in the run history, never silent. The admin sees every AI request with its cost, and revoking an integration never deletes what was already logged or filed.

Every change on record

Who did what and when, kept and unchangeable, and open to the people who need it.

Sources: N-06, N-08; D-033, D-035, D-038; RK-02; S-02 §6; S-03 §7, T5; Audit and history; ADM-C04, C17, C21, C22, C28, C52

In V1
Every change is written down
Who, what changed (the old and the new value), on which record or setting, and when. It covers creating, changing and removing, the actions of the AI, every request through the AI connector, reads included, and every export.
In V1
The record cannot be edited
An entry is never changed or removed, not even by the admin; if an entry cannot be written, the change is not saved. Erasing a person’s data keeps the change itself and replaces only the personal values with a marker.
In V1
Open to the people who need it
Partners / MD and the Admin read and search it by record, person, kind of change or date. The old and new values of the private Land log are masked in the Admin’s view; Land and the Partners / MD see them.
In V1
A reason is asked where it matters
Exports, erasures, duty changes, a promotion to Admin and the reopening of a closed Site carry the reason given.
In V1
Every AI output carries its source, confidence and approver
What the AI proposed, where it read it, how sure it was and who approved it are recorded. A proposal that is discarded leaves only its log entry.
In V1
A figure can be traced back to where it came from
Appraisal and fee figures are fixed calculations, checked against Valere’s real appraisals before acceptance, and every figure is traced to its source.
In V1
Settings have a history of their own
Every internal role reads the history of ordinary settings, so a PM can see why a Site stalled after a threshold changed. Rates, credentials and integration settings are shown to the Admin and Partners / MD only.
In V1
A leaver’s name stays on what they did
A deactivated person keeps their name on past records, actions and log entries.

What is promised, and what is not yet

The honest list: what is not promised yet, and whom to ask.

Sources: S-02 §6, §8; S-03 §8, T16, T26; RK-11, RK-14; D-040; ADM-C16, C22, C55; LGN-C04; Decided outside

Nothing below is a promise, and none of it is hidden. If a questionnaire asks for it, the answer today is “not set in the documents”, with the person to ask.

Not promised yet	What the documents say	Whom to ask
A certification, such as SOC 2 or ISO 27001	No document names one, so none is claimed. SOC 2 is an independent report on how a provider protects customers’ data; ISO 27001 is an international standard for running information security.	Apiko (the build)
An independent penetration test	Not planned in any document. It is a test in which outside specialists try to break in and report what they found.	Apiko (the build)
How fast it is back after a failure, and how far back the backups reach	Daily backups with a tested restore are required; Valere asks Apiko how long backups are kept and when a restore will be tested (T26). The time to recover is not set anywhere.	Apiko (the build)
Availability outside working hours	The 99.5% target is for working hours only.	Apiko (the build)
The hosting provider and the exact region	The documents say the UK or the EU and name no provider.	Apiko (the build)
What Apiko’s engineers may reach in production, and what is logged	Only the installation is described: the first Admin and the Microsoft connection, recorded in the audit log.	Apiko (the build)
Keeping the software and platform current, fixing a weakness, and telling Valere about an incident	No document sets a routine, a time limit or a notice. Defects found in the first 60 days after go-live are fixed at no charge; no support arrangement is written for after that.	Apiko (the build)
A notice to the owner when a token is created on their account	The letter is designed on the Email templates page, but no document promises it. Warnings about sign-in itself belong to Valere’s Microsoft 365.	Apiko (the build)
A list of signed-in devices, and “sign out everywhere”	Not described. Sign-in itself, and what Microsoft does after repeated wrong attempts, belong to Valere’s Microsoft 365.	Apiko (the build)
Virus checks on files, and versions of files	Files live in Valere’s SharePoint, under Valere’s own Microsoft 365; the CRM keeps only a link and a category, and promises no checks or versions of its own.	Apiko (the build)
A read-only account for an outside auditor	The audit log is read by the Partners / MD and the Admin. A separate auditor role is not in any document.	Apiko (the build)
How long personal data is kept	Valere sets the period in the product; no document gives a number. Data collected for lead generation can have its own period per source.	Valere’s data-protection advice
The lawful basis for the personal data lead generation collects	Names of applicants, agents and owners come from planning portals and the Land Registry. The lawful basis and the notice to those people are not settled; Valere’s data-protection advice is a deliverable before the first scheduled run.	Valere’s data-protection advice
The idle sign-out time	It is a setting, in whole minutes; no value is set.	Valere’s admin, once appointed