Security is not a feature. It's our foundation.
We built VarShield to protect your data from AI overreach. That starts with how we handle your data ourselves.
“We see behavior. Never content.”
VarShield's privacy-by-design architecture means we analyze metadata and behavioral signals only. We physically cannot read your files, emails, messages, or documents.
Privacy by design
What we see vs. what we don't
What we analyze
- OAuth scopes and permissions granted to AI tools
- Connection timestamps and frequency patterns
- API call metadata (endpoint, method, status code)
- App identifiers and version information
- Permission change events and audit logs
- Behavioral signals (access patterns, anomalies)
What we never access
- File contents, documents, or attachments
- Email bodies or message content
- Chat conversations or meeting transcripts
- Database records or application data
- Credentials, passwords, or API keys
- Any personally identifiable content
Enterprise-grade security
How we protect your data
Metadata-only analysis
VarShield never reads your files, emails, messages, or documents. We analyze connection metadata, OAuth scopes, and behavioral signals — never content. Our architecture makes it technically impossible for us to access your data.
Encryption standards
All data is encrypted at rest using AES-256 and in transit using TLS 1.3. API keys and OAuth tokens are stored in hardware-backed secret managers with strict access controls.
Data residency
Choose where your metadata is processed and stored. We support EU, US, and APAC data residency options to meet your regulatory requirements.
Zero-trust architecture
Every request is authenticated and authorized. We follow the principle of least privilege across our entire infrastructure. No standing access to production systems.
GDPR & PDPA compliance
VarShield is fully compliant with GDPR, PDPA, and other major data protection regulations. We provide data processing agreements, support data subject requests, and maintain transparent data practices.
SOC 2 Type II
We are pursuing SOC 2 Type II certification covering security, availability, and confidentiality. Our controls are continuously monitored and regularly audited by independent third parties.
Compliance & certifications
SOC 2 Type II
In progressGDPR
CompliantPDPA
CompliantISO 27001
PlannedHave security questions?
Our security team is happy to discuss our architecture, provide documentation, or walk through our compliance posture.