Security and trust
What the product enforces,said specifically
Every line on this page describes behaviour in the software today, not an intention. Where something is not available yet, it says so.
[ 01 ] Access
Who can reach what
Roles on every request
Owner, admin, manager, team lead, employee and client. Roles decide pages and actions, and the API checks every request, not just the sidebar.
Grants finer than roles
Cost view (rates, cost, margin) and client information are granted per person; seniority does not imply them.
Workspaces are isolated
Each organization's data is separate; one sign-in can belong to several, each scoped on its own.
The client portal is a restricted read model
A portal session receives only client-visible data for that client. Internal work is never sent to the browser to be hidden there.
[ 02 ] Sign-in
Getting in, and being stopped
Single sign-on (SAML or OIDC)
Single sign-on through your own identity provider over SAML or OIDC (for example Okta, Microsoft Entra ID or Google Workspace). Your company's email domains, proven by a DNS record, sign in through it. On the Agency plan.
SCIM provisioning
Your identity provider adds, switches off and removes people and syncs groups, across every Varynt product. New people get no access until a group or an admin gives it, and synced groups stay read-only in Varynt. With single sign-on, on Agency.
Two-step sign-in
Each person can turn it on; admins see who has and can reset it.
IP allow-list
Owners and admins can restrict the workspace to listed networks. A list that would lock out the person saving it is refused.
Idle sign-out
Customer sessions end after 30 minutes without activity.
Leavers
Deactivating a person stops access immediately. Across the suite, Varynt can end every session, personal token and connected assistant for one person.
[ 03 ] Data
How it is kept, and how long it stays
Files behind signed links
Uploaded files are reached through short-lived signed links, so a file address cannot be passed around and keep working.
Retention, as enforced
Audit log: for the life of the workspace. Activity feed: 90 days. Notifications: 7 days after being read, 30 if never read.
Your data out
Lists export to CSV; reports to CSV, Excel or PDF, whenever you like.
Imports you can undo
A spreadsheet import shows what will be added, overwritten or skipped before writing, and one click reverses it.
[ 04 ] AI assistants
A ceiling below your own access
An assistant connected over MCP acts as the person who connected it, and never sees personal contact details, rates, costs, margins or workspace settings, whatever that person's role. Connections are listed in each profile and end in one click.
[ 05 ] Compliance
What we claim, and what we don't
Varynt operates under the law of India, including the Digital Personal Data Protection Act. We do not claim a security certification today. For a security questionnaire or a data processing question, write to work-contact@varynt.in.
Single sign-on over SAML or OIDC, and SCIM provisioning, are on the Agency plan.