varityvarityLast updated · April 25, 2026
Security is one of three product principles at Varity (the others are workflow integrity and brand truth). Here's how we run it.
Varity runs on Vercel and Supabase, with workers on a separate Redis-backed queue. Every request is multi-tenant scoped at the database level — every row carries a organizationId, every query is filtered by it, and we have automated tests that fail builds when a query touches a table without that filter.
All traffic is TLS 1.2+ end-to-end. All data at rest is AES-256 encrypted by the database and object-storage provider. Connected-account tokens and bring-your-own-key secrets sit behind an additional envelope-encryption layer and are never logged in plaintext.
Inside the product, role-based access control governs who can publish, approve, or change brand. Inside our team, production access is gated by SSO + hardware key + short-lived credentials. Engineers do not have ambient access to customer data; production reads require a paired session and are logged.
Every state-changing action — publish, approval, brand edit, integration connect — writes an EventLog row visible to workspace admins. Internal infrastructure logs are retained for 90 days and shipped to a write-only store; we cannot edit them after the fact.
We run a PagerDuty rotation 24/7. For any incident classified Sev-1 or Sev-2 we publish a status update within 60 minutes and a postmortem within 5 business days. Customers affected by a security incident receive direct notification within 72 hours of confirmation.
We are SOC 2 Type II in progress (target audit window: H2 2026). Enterprise customers can request our security questionnaire, sub-processor list, pen-test summary, SSO/SAML, SCIM, IP allow-listing, and bring-your-own-key encryption.
If you think you have found a vulnerability, please email security@prism.app. We acknowledge within 24 hours, fix high-severity issues within 7 days, and credit researchers in our hall of fame unless they prefer to remain anonymous.
This page is informational and reflects how Varity currently operates. It is not legal advice and does not replace a customer agreement; enterprise customers receive a signed DPA and order form alongside these public terms.