Frequently asked questions

General

Do we need technical knowledge? No. You need to be able to add a DNS record, or ask your IT partner to do it. Every finding comes with remediation steps in plain language.

Is Värn a penetration test? No. Värn is continuous, external and passive monitoring. It complements, but does not replace, penetration tests or reviews of internal systems.

Do the checks affect our website? No. Värn makes the same kind of requests as a web browser, at a limited rate and without submitting forms or trying passwords.

Is Värn available in English? Yes. The app, its findings and the reports are available in English and Swedish. Värn is built for businesses in Sweden, and some guidance (for example on the Swedish Cybersecurity Act) is written with Swedish conditions in mind.

Domains and scope

Can we add a domain we do not own? No. Every domain has to be verified with a DNS record before anything is checked.

What happens if we remove the TXT record? At the next automatic check (every 30 days), the verification lapses and monitoring is paused. You can verify again at any time.

Does Värn follow redirects to other domains? No. Redirects to another domain are noted but not followed. Add and verify that domain separately if it should be monitored.

Data and privacy

Where is our data stored? Customer data is stored with our database provider in an EU region. See the privacy policy.

Do you store passwords from data breaches? No, never. Breach monitoring is coming soon; once it runs, only which accounts are affected and which types of data leaked are stored.

How long are scan results kept? Raw check results are deleted after the retention period you choose (30–1,095 days). Findings and the activity log are kept for as long as the organisation exists. Notifications are kept for 12 months and the audit log for 24 months.

Can we export or delete all our data? Yes. Under Settings → Data and deletion, administrators can download everything Värn stores about the organisation as a JSON file, and owners can delete the organisation with all its data permanently.

Regulations

Will Värn make us NIS2 compliant? No tool can make you compliant. Värn gives you evidence and documentation that support your work. Read more in the article about the Swedish Cybersecurity Act.

Can we use the reports in an audit? Yes, as evidence. The reports have timestamps, version numbers and a checksum, and they state their limitations clearly.