Trust and security

What we do to protect your business's records.

Every line on this page describes what the Varynt products do today. Where something is not available yet, we say so. Each product's own security page has the details.

Ask a security question Privacy policy

Who can see and do what

Roles checked on every request: Each product's roles are sets of capabilities the server checks on every request, not menus that are merely hidden.
Least access by default: People get the access their role gives them in each product, decided separately per product. A person can be an admin in one and a viewer in another.
Roles in one place: A role can apply to one Work project or client, one Desk location, one Invoice branch or one Knowledge space instead of the whole product.
Groups, explained: Groups give roles to their members, and Check access shows exactly why a person can or cannot do something, down to the group path.

One Varynt sign-in: The same account opens every product your organization uses, so there is one password to protect, not four.
Two-step sign-in, required if you choose: A six-digit code from an authenticator app on top of the password. An organization can require it for everyone, and see who has not set it up yet.
Single sign-on: Sign in through your own identity provider over OIDC or SAML 2.0, on email domains you prove with a DNS record. On the top plan of any product.
SCIM provisioning: Your directory adds, switches off and removes people and syncs groups across every Varynt product. On the same plans as single sign-on.
Network rules: Allowed IP ranges, set once for the organization and enforced on every request in all four products.
Sessions that end: Sessions left alone end after a period of inactivity, and suspending a person stops their access in every product.

Your records

Organizations kept apart: Every request is checked against the organization it belongs to; a valid sign-in for one cannot read another's data.
Each product owns its data: Products keep their own records and pass nothing to each other unless you connect them.
An audit log in words: Who did what across the organization, with names rather than ids, filterable and exportable. Each product also keeps its own history of changes.
Support access you control: Varynt support can open your Work workspace only when an owner grants it, for a limited time, with every session checked against the grant and recorded in your audit log.
Exports: Lists and reports export from each product whenever you need them, so your records are never locked in.

How we run it

Encrypted in transit: Every page and API call is served over HTTPS.
Backed-up releases: Before a release changes anything, databases are backed up and the backup is restored and checked, with a way back for every step.
Rate limits: Public pages, forms and sign-in paths are rate limited, so a script cannot hammer them.

Compliance

We operate under India's Digital Personal Data Protection Act, 2023. For what your team puts into a Varynt product, you decide what is collected and why, and we process it on your behalf to run the product, and for nothing else.

We hold no third-party security certification today, and we will not claim one until we do. We will list certifications and audit reports here when we hold them.

Security questionnaires from procurement teams are welcome: write to sales@varynt.in. To report a vulnerability, write to the same address; please give us a reasonable time to fix it before you disclose it.

Product security pages

Roles, retention periods, exports and plan-specific controls differ by product. Each product's page lists them exactly.

This website itself: see the privacy policy for what the contact form collects.

Get in touch

Have a security review to run?

Send us your questionnaire. The engineers who built the products will answer it.