Trust

Trust is part of the method.

High-stakes organizations trust us with donor relationships, partner due diligence and people in sensitive places. Here is how we handle that trust. Ask us for anything you do not see here.

Salesforce-native by default

Client records stay in your Salesforce org, under your security model, your sharing rules and your audit trail. We work inside it rather than copying it out.

Confidential by design

Personnel, compensation and donor matters stay out of group sessions and shared examples. Customer stories on this site use only figures our clients have cleared.

A human in the loop

AI drafts, summarizes and challenges. People approve. Decision weights are set by people and computed deterministically, so every recommendation can be explained.

Least privilege

Volley staff and contractors get the minimum access a task needs, with multi-factor authentication, and access is removed when the work ends.

Privacy for the people in the field

Volley Mirage blurs the faces of minors, strips location metadata from photos, and tracks consent for every person and every item before anything is published.

Secrets stay out of code

Credentials live only in environment variables on the hosting platform, never in repositories, documents or email.

Email and domain

Our own house, in order.

DMARC enforcement at reject, SPF with a strict policy, and DNSSEC on VolleySolutions.com
Certificate issuance restricted to approved authorities through CAA records
Website forms send through a transactional email provider; nothing is stored on the website itself
Web analytics without cross-site tracking cookies

Subprocessors

The platforms we build on.

Which of these touch your data depends on the services you use. We list the specific subprocessors in every statement of work.

Salesforce: CRM platform for Volley Relate and client orgs
Nintex (Skuid): User interface for the Volley Decision Engine™
Vercel: Hosting for this website and web apps
Resend: Transactional email for website forms
AI model providers: Anthropic, OpenAI and Google, used through their business APIs

Need a security review?

We will complete your questionnaire and walk your team through our controls.