How your data is handled when a file is uploaded through Upload & Share
This page explains what happens to your data when a file is uploaded through Upload & Share, who can access it, and what controls are in place.
If your organisation has previously assessed Validis from a governance perspective, Upload & Share does not change that position.
How your data is handled
Any AI used is aligned to the same region as your portal. For US portals, AI processing is in the US. For UK portals, AI processing is in the EU.
Is our data used to train AI models?
No. Validis does not train AI models, and client data is never used to train any AI model.
Is our information retained after processing?
Not by the AI. The AI models keep nothing once processing has completed. As with every upload, the file and the standardised data are stored securely in Validis for the engagement, and the processing working copies and records are deleted after 90 days.
Could one client's data affect, or be visible in, another client's processing?
No. Information from one client cannot be accessed by, or influence the processing of, another client engagement.
Does the system learn from our engagements over time?
No. Behaviour only changes through Validis’s controlled software development and deployment process, not automatically from the files you upload.
How is access to an uploaded file controlled?
Files are shared with client permissions. Validis staff only access your data in accordance with our Support Policy, to investigate or resolve issues.
What the AI does, and does not do
Upload & Share is not a black box making judgement calls on your numbers. The AI’s job is to understand how a file is arranged: where account codes, descriptions, balances and dates sit. It then proposes rules that map that structure into the Validis standardised format, including which standard category (for example, current assets) each account belongs to. It does not change the amounts.
If the AI proposes the rules, can anyone check them?
Yes. The AI only proposes rules, and those rules are human-readable, deterministic and reviewable.
Is an AI model running every time a file is processed?
Only at the start. AI checks each file and confirms or sets up the rules for it, reusing rules proven on earlier files where it can. Working through the data is then a fixed, repeatable procedure applied by those rules, with no AI involved.
What does "deterministic" mean here?
The same file processed under the same rules always produces the same result. The logic does not change based on previous files or engagements, and it does not keep learning after deployment.
What was the capability built on?
Validis-controlled internal datasets and test scenarios, designed to handle a wide variety of data structures. It was not developed by learning from customer engagements.
Improvements come from our Managed Service and Engineering teams. Where a file does not process well, Validis staff identify the root cause, then build, test and deploy a change through the normal development process. The system does not alter itself based on your file.
Access and review
All manual review is carried out by Validis staff in an internal system. There is no customer-facing review step, and customers and clients never see it.
Certifications and standards
Upload & Share sits within Validis’s existing SOC 2 and ISO 27001 audit boundary. Data is protected to ISO, SOC 2 and GDPR standards.
Auditability
Upload & Share is auditable end to end. Every cell of every output can be traced back to the source input and the specific rule that produced it.