The Short Version

Your data is encrypted in transit, your secrets are isolated and never logged or built into images, and each account is isolated from every other. We own the platform's security; you own your application and the data inside it. Found a vulnerability? Email security@varity.so.

How we protect your data

Encryption in transit: All traffic between you, Varity, and your deployments is encrypted with TLS, with HTTP Strict Transport Security enforced.
Isolated secrets: Environment variables and credentials are injected at runtime, never built into images, and never written to logs.
Account isolation: Each account's deployments and data are isolated from other accounts.
Least-privilege access: Access to internal systems is restricted on a least-privilege basis.
Hardened deploy path: Inputs to the build and deploy pipeline are validated to prevent injection and server-side request forgery.
Multi-factor authentication: Available on your account through our identity provider.

Shared-responsibility model

Security is a partnership. Here is who owns what:

Varity owns

The platform and control plane: edge encryption, routing integrity, the deploy pipeline, secret injection, the registry, billing, and patching our own services.

Infrastructure providers own

The underlying hosts: physical security, the host operating system, and container-runtime isolation. We select and continuously evaluate providers.

You own

Your application: your code and dependencies, your in-app authentication, the secret values you provide, and the data your app stores.

Infrastructure and providers

Your workloads run in isolated containers on distributed cloud infrastructure. Varity manages provider selection on your behalf — you never have to pick or configure infrastructure. We continuously evaluate providers for reliability and route around any that underperform.

Routing workloads with stricter requirements to infrastructure providers that operate from SOC 2 Type II and ISO 27001 certified data centers is on our roadmap and is not available today.

What we're building next

We believe in being clear about what is in place today versus what is on the way. In active development:

Platform-managed encryption at rest across stored data
Tamper-evident audit logging and a documented incident-response process
Team accounts with role-based access control
A trust center with compliance documentation as we mature

Reporting a vulnerability

If you discover a security vulnerability, please report it responsibly. Do not open a public issue.

Email: security@varity.so
Machine-readable contact: /.well-known/security.txt

We aim to acknowledge reports within 48 hours and will keep you updated on remediation. We appreciate the security community's help in keeping Varity safe.

Data handling and privacy

We collect only what we need to run the service, we never sell your data or use it for advertising, and we never train AI models on it. For full details, see our Privacy Policy and Terms of Service.