Security & Trust
Varanic is built with enterprise-grade security at every layer. We protect your portfolio company data, financial analyses, and portfolio intelligence with the same rigor that institutional finance demands.
Compliance Certifications
SOC 2 Type 1
Attested by Sensiba LLP, May 2026. Attestation letter on request; full report under NDA.
SOC 2 Type 2
Attested by Sensiba LLP, July 2026, covering the design and operating effectiveness of our Security controls over the April 7 – July 7, 2026 period. Attestation letter on request; full report under NDA.
"Attested" indicates an issued third-party audit report. Technical controls described on this page are implemented in the platform today. Contact [email protected] for the latest certification status and supporting documentation.
How We Protect Your Data
Encryption
- AES-256 server-side encryption for document storage in Amazon S3; production database resides on encrypted storage volumes managed by the cloud provider
- TLS 1.2+ for data in transit, terminated at the Cloudflare edge in front of production
- Field-level encryption for sensitive data on roadmap; volume-level encryption active today
- Key rotation managed through cloud provider infrastructure; application-level rotation on roadmap
- Encrypted daily database backups with cross-region replication and weekly restore drills
Data Ownership & Handling
- SEC EDGAR data sourced exclusively from public filings maintained by the SEC
- Customer-uploaded financial data remains the sole property of the customer at all times
- Customer data is never sold
- Configurable data retention policies with full customer control
- Secure and verifiable deletion of all data upon account termination
How The Platform Is Secured
Architecture & Access Control
- Multi-tenant isolation: every database row scoped to account_id with rigorous controls to prevent cross-tenant data access
- Role-Based Access Control (RBAC) with admin, user, and viewer roles enforcing granular permissions
- MFA support with TOTP-based authentication and configurable device trust policies
- Session-based authentication with secure token management and automatic expiration
- Input validation on API endpoints; expanding sanitization coverage across all routes
API Security
- API key authentication required for all programmatic access
- Rate limiting on all endpoints to prevent abuse and ensure availability
- HTTPS-only access to production; HTTP requests are redirected to HTTPS at the Cloudflare edge
- Request validation and content-type enforcement on API calls
How We Maintain Trust
Audit Trail & Monitoring
- Audit trail of user create, update, and delete actions with precise timestamps
- User attribution on every action for full accountability and traceability
- Append-only audit log storage designed to resist tampering
- Activity monitoring dashboard; automated anomaly detection planned
Vulnerability Management
- Third-party penetration testing completed April 2026; authenticated retest planned
- Responsible disclosure program active — report vulnerabilities to [email protected]
- Dependency scanning integrated into the development workflow via automated tooling
- Security incident response plan documented with severity levels, escalation paths, and notification timelines
Trust Center
Legal agreements are available below. Security policy documents are shared under NDA during the sales process — request access directly or contact [email protected].
Legal Agreements
Compliance Reports
Available on request. Email [email protected] with your company and use case.
Security Resources
Available under NDA during the sales process. Request access below or contact [email protected].
Have Security Questions?
Our security team is ready to discuss our practices, share documentation, or address any concerns about how we protect your data.
[email protected]