Security
Built to handle sensitive information
Your security posture is information an attacker would love to have. That is why Värn is designed with the same principles we recommend to you.
Isolation per organisation
All data belongs to an organisation and is protected by row-level security (RLS) in the database, least privilege and composite foreign keys. The isolation is verified by automated tests on every change.
Verified scope
Värn only contacts domains where you have published a unique DNS record. Ownership is checked again every 30 days, and if the record is removed, monitoring stops.
Protection against scanner abuse
The scanner never connects to private or reserved addresses, cloud providers' metadata services or internal names. Every connection is validated again to stop DNS rebinding.
Passive checks only
Ordinary DNS lookups, TLS handshakes and HTTP requests to the home page. No passwords are tried, no forms are submitted and no vulnerabilities are exploited.
Minimal data collection
Breach monitoring (coming soon) stores only the breach name, the types of data and the affected accounts – never passwords. Cookie values and variable secrets in responses are never stored.
Strong sign-in
Passwords of at least 12 characters, a confirmed email address and two-step verification (TOTP). Organisations can require two-step verification for every member.
Roles and permissions
Four roles with clear boundaries. Permissions are checked both in the application and in the database, and the last owner can never be removed.
Audit log
Permission changes, verifications, deletions and reports are logged with time and actor and cannot be changed afterwards.
Web security
A strict Content-Security-Policy with a one-time nonce, HSTS, protection against framing and CSRF, and error messages that never leak internal details.
Transparency
What we do not claim
Trust comes from being clear about limitations.
We are not certified. Värn does not currently hold ISO 27001 or SOC 2 certification. We work to OWASP ASVS and are open about our controls.
We do not replace a penetration test. Our checks are external and passive. Internal systems and application logic are not assessed.
No source covers every data breach. Finding nothing does not mean no data has leaked.
Customer data is to be stored in the EU. The database and authentication run with a provider in an EU region. Subprocessors are listed in the privacy policy.
Responsible disclosure
Found a vulnerability in Värn? Contact us at security@varnsecurity.se. Describe the problem and how to reproduce it. We will confirm receipt, keep you informed and take no legal action against anyone who reports in good faith.
