Varity owns
The platform and control plane: edge encryption, routing, the deploy pipeline, secret injection, and patching our own services.
Security and shared responsibility
Security is a partnership between Varity and you. This page explains what Varity protects, what you are responsible for, and how to reach us about a security issue.
What Varity protects
Section titled “What Varity protects”- Encryption in transit: public Varity product endpoints and deployment routes are served over HTTPS. Do not infer a broader transport or HSTS guarantee from this statement.
- Protected inputs: secret values use write-only customer interfaces and are not returned by the environment-variable read path. Customers remain responsible for values their own applications print or transmit.
- Owner-scoped control paths: authenticated deployment and machine reads are scoped to the owning account.
- Validated deploy inputs: the public deploy interfaces validate supported source, image, network, and resource shapes before execution.
These are scoped platform controls, not a certification statement or a claim that Varity and the selected infrastructure never process customer data.
Shared-responsibility model
Section titled “Shared-responsibility model”Infrastructure owns
The underlying hosts: physical security, the host operating system, and container-runtime isolation. Varity selects and continuously evaluates providers.
You own
Your application: your code and dependencies, your in-app authentication, the secret values you set, and the data your app stores.
Your responsibilities in practice
Section titled “Your responsibilities in practice”- Keep your application dependencies up to date.
- Implement authentication and authorization inside your own application.
- Treat the environment variables you set as sensitive, and rotate them if they are ever exposed.
- During beta, keep your own backups of business-critical data.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Found a security issue? Email security@varity.so. Please report it responsibly and do not open a public issue. We aim to acknowledge reports within 48 hours and will keep you updated on remediation.
On our roadmap
Section titled “On our roadmap”Platform-managed encryption at rest, broader confidential-compute coverage, tamper-evident audit logging, team role controls, fully homomorphic encryption, and post-quantum migration are roadmap architecture. They are not current product-wide controls. Any future confidential-compute statement will name the supported workload and adapter instead of implying universal coverage.