Trust center · v2026-07
Security & compliance.
The channel data you upload — VAR org trees, rep emails, account ownership — is some of the most sensitive in your business. Here's exactly how we protect it.
Pillars
How your data is protected.
Encryption controls
Browser and API traffic uses HTTPS, while managed storage and application-level encryption protect stored data as described below.
- HTTPS is enforced for browser and API traffic
- Hosted Postgres uses Supabase's managed at-rest storage controls
- CRM OAuth credentials encrypted at rest (AES-256-GCM, application layer)
- Production secrets are supplied through server-side environment variables rather than application source
- Automated secret scanning runs in continuous integration on every push and pull request; a build that introduces a credential fails
- Dependencies are pinned, and an automated posture check runs daily in continuous integration against known advisories; advisory overrides are documented and reviewed
- A written incident-response plan is maintained covering detection, triage, containment, customer notification, and post-incident review; personal-data breach notification is committed contractually at 72 hours in our Data Processing Addendum
Tenant isolation
Tenant-owned reads and writes are scoped by organizationId, with database constraints protecting workspace boundaries.
- Tenant-owned business records carry organizationId; global identity and control-plane records are kept separate
- Interactive application requests resolve the active organization before tenant data is read or changed
- Enforced, not advisory: a continuous-integration check fails the build if a query is written without an organization scope, so an unscoped query cannot reach production
- An independent runtime backstop is implemented and ships with the application; it currently runs inert and moves to warn-then-enforce once a staging environment is available to validate it safely. Database-level row-level security is planned behind the same milestone
- Composite foreign keys protect key cross-workspace relationships at the database boundary
- Composite indexes on (organizationId, …) make scoping the fast path
- Tenant-owned cache keys include organizationId
Identity & access
Clerk handles authentication. Every user can enroll a TOTP authenticator app as a second factor; organization-wide MFA enforcement is implemented but is not enabled today.
- Password storage and credential verification are handled by Clerk
- Every user on every plan can enroll a TOTP authenticator app as a second factor
- Organization-wide MFA enforcement — requiring it of every member — is built and tested but is NOT enabled today; we will notify customers in advance of enabling it
- The enforcement gate, when enabled, verifies both account enrollment and second-factor evidence for the current session
- Enterprise: SCIM provisioning for joiner / mover / leaver workflows
- Per-org roles: Administrator and Member. Administrators manage settings, integrations, imports, team membership, and API credentials; Members have full read and write access to channel data but cannot change organization settings. A read-only Viewer role is on our roadmap
Audit logging
The app records tenant audit history for administrative operations such as imports, exports, and role changes, plus best-effort session and access-denial markers.
- Mandatory audit writes are atomic with high-impact data mutations
- Structured actor, action, and entity context with minimized, sanitized request metadata
- Audit records cannot be created, edited, or deleted through the application, with one deliberate exception: a data-subject erasure request redacts personal data from the metadata of existing records so the ledger cannot be used to reconstruct erased personal data. The record, its actor, its action, and its timestamp are preserved, and the erasure is itself audited (GDPR Article 17)
- Configurable retention (90 days / 1 year / indefinite)
- Growth and Enterprise: CSV export with full filter support for evidence collection
- Best-effort PERMISSION_DENIED markers for denied admin-route access
Frameworks
Compliance posture, honestly stated.
| Framework | Status | Detail |
|---|---|---|
| SOC 2 Type II | In progress | Program in progress. VAR Conduit has not yet completed a SOC 2 audit and is not certified. |
| GDPR | Controls available | DPA template available for review. Per-person erasure + organization-wide data-wipe tooling built into the product. (EU representative not yet appointed.) |
| CCPA / CPRA | Controls available | Same erasure + portability tooling as GDPR. Privacy policy enumerates data categories. |
| ISO 27001 | Roadmap | On the roadmap after SOC 2 Type II — not yet started. Listed for transparency, not as a current control set. |
Documents
The document library.
Privacy policy
What we collect, why, and how we protect it — written to match how the product actually works today.
Read the documentTerms of service
The terms governing your access to and use of VAR Conduit.
Read the documentData Processing Addendum
How we process personal data on your behalf; reach out to execute a countersigned copy for procurement.
Read the documentSecurity overview one-pager
A draft trust summary for vendor review; deployment-specific details are confirmed during procurement.
Draft available for review via security@varconduit.com
CAIQ-Lite questionnaire
A draft CAIQ / SIG-Lite style self-assessment — honest gaps included and customer-specific details confirmed on review.
Draft available for review via security@varconduit.com
Disclosure & contact
Found a vulnerability or have a compliance question? We'd rather hear from you than read about it later.
Last reviewed · July 2026