CCPA

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents rights over their personal information and sets duties for businesses and for the service providers that work for them. It is a state law, not a certification, and it is enforced by the California Privacy Protection Agency and the California Attorney General.

Where we are

Today Vaulty serves companies in the European Union and does not meet the thresholds that make a company a "business" under the CCPA, so we do not claim CCPA compliance. Our processing is built for the GDPR: we process personal information only on our clients' instructions, we do not sell or share it, we do not train AI models on it, connections are read-only, access is role-based and activity is logged. Much of what the CCPA expects from a service provider already follows from that.

What is planned

Before we take on a client that is subject to the CCPA, we will add the service-provider terms required by the CCPA regulations to our contract, set up a process to help that client answer requests to know, delete and correct personal information within the legal deadlines, and support its risk assessments and cybersecurity audits. This card will change when that happens.