Security at Varhugi

For security officers

The ten questions a vendor review usually asks, each answered in one line with a link to the section or document that backs it.

1. 1. What data is stored

   Staff name, email, department and role; training progress, quiz results and certificates; reports of suspicious messages and policy attestations submitted by staff; sign-in records (time, IP, browser). Nothing else.

   Categories of data in the DPA

2. 2. Where it is hosted

   Vercel, with the database at Neon in Frankfurt, inside the EEA. Point-in-time database restore and instant rollback of deployments.

   Hosting

3. 3. Authentication

   No passwords. Email link or SSO with Microsoft and Google, where your MFA applies. Admin, manager and staff roles. Server-side sessions, admins signed out after four hours idle.

   Sign-in and access control

4. 4. User provisioning

   SSO users join automatically and roles sync from Entra app roles. SCIM provisioning for Entra ID creates members and deactivates leavers automatically; deactivated members keep their history and free their seat.

   SCIM setup guide

5. 5. Encryption

   TLS for all traffic, encryption at rest in the database.

   Technical safeguards

6. 6. Who at Varhugi can access your data

   A few named accounts with access to the production environment. Staff do not sign in to customer workspaces. Customer admin actions are audit-logged.

   Staff access

7. 7. Security testing

   Automated dependency audit on every change and weekly. Full code review in July and September 2026. No independent penetration test yet.

   Security review

8. 8. Incident response

   Notification without undue delay and as a rule within 48 hours of Varhugi becoming aware of a breach affecting your data, with follow-up as the investigation progresses.

   Security incidents

9. 9. GDPR

   Data Processing Agreement applies automatically. Five named subprocessors, 30 days' notice of changes. Data deleted or returned within 30 days of contract end.

   Data Processing Agreement

10. 10. Assurance

    No ISO 27001 or SOC 2 for Varhugi itself. Vercel and Neon hold SOC 2 Type 2. No SLA on current plans.

    Certifications

Hosting and data storage

The service runs on Vercel. Data is stored in a database at Neon in Frankfurt, Germany, and issued certificates in Vercel file storage, also in Frankfurt, both within the European Economic Area. Email, such as sign-in links and reminders, is sent through Resend.

Some subprocessors are US companies. Where personal data is transferred outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses (SCC) or the subprocessor's participation in the EU-US Data Privacy Framework.

Sign-in and access control

• No passwords

  Varhugi stores no passwords. Sign-in happens via a verification link sent by email or through your workplace identity provider, so there is no password database that can leak.

• SSO with Microsoft and Google

  Staff sign in with their workplace Microsoft Entra ID or Google account, so your own MFA and conditional access policies apply at sign-in. Varhugi has no MFA of its own; with the email link, security rests on access to the mailbox. A disabled account can no longer sign in, but the person remains a member in Varhugi until removed under People or deactivated through SCIM.

• Role-based permissions

  Permissions follow roles. Regular staff see only their own training, and administrators see the status of their own company, no one else's.

• Tenant isolation

  Each company's data is separated from every other's, and all queries are scoped to the signed-in user's company.

Technical safeguards

• Encryption in transit and at rest: all traffic runs over TLS and database contents are encrypted at rest.
• Least privilege in the database: the application connects as a role that can only read and write rows. It cannot alter or drop tables, and schema changes run only through a separate owner role the application never uses.
• Security headers on every page: an enforced Content-Security-Policy with nonces that only allows the site's own scripts, HSTS with preload, X-Frame-Options: DENY, nosniff, Referrer-Policy and Permissions-Policy.
• Rate limiting on sign-in and other sensitive endpoints protects against guessing attempts and abusive traffic.
• Security updates to software dependencies are part of the service's regular maintenance.

Architecture and operations

Here are the answers a vendor review needs. The detailed technical description, the security whitepaper, is available to signed-in admins, the free workspace included.

Components

The application runs on Vercel in Frankfurt and all persistent data, the database and issued certificates, is hosted there too, within the EEA. The rate-limiting cache holds only hashed identifiers, never plain email addresses or IP addresses. Varhugi operates no servers of its own.

Separation between customers

Tenant separation is enforced on every single query: a user reaches only their own workspace's data and a department manager only their own department. Org-wide power is limited to admins.

Sign-in and sessions

Users sign in with a single-use link sent by email, valid for 15 minutes, or with Microsoft or Google sign-in (SSO). Varhugi stores no passwords. Rights that derive from an email address, invitations and signup links, are only granted to verified addresses. Sessions are stored server-side, last at most 30 days and end the moment a user signs out. Admin and manager sessions are also closed after four hours of inactivity.

Audit trail

Security-relevant admin actions are written to an append-only audit log: sign-ins, role changes, removals, invitations, assignments, SCIM events, policy confirmations and reports, each with actor, target, time and IP address. Admins can browse it under Settings and export it as CSV.

Staff access and secrets

Varhugi staff do not sign in to customer workspaces; access to the operations environment is limited to a few named accounts. All secrets live in the hosting platform's configuration, never in source code, and can be rotated without a code change.

Vulnerability management

Software dependencies are audited automatically on every code change and again every week. A high or critical advisory blocks the release until it is fixed. The whole codebase was reviewed for security in July 2026 and again in September 2026 with a focus on tenant isolation, as described below.

Backups and recovery

The database provider keeps a continuous history of changes, so the database can be restored to a point in time rather than only to the last nightly copy. The application is deployed from version control and every deployment is kept, so a faulty release can be rolled back within minutes.

Certifications

Varhugi holds no ISO 27001 or SOC 2 certification and does not claim to. The providers that run the infrastructure, Vercel and Neon, hold SOC 2 Type 2 and publish their reports on their own trust pages. No formal uptime guarantee (SLA) is offered on the current plans.

Security review

A thorough security review of the service's entire codebase was carried out in July 2026 and again in September 2026, the latter focused on tenant isolation, role boundaries and authentication, and the resulting fixes were shipped. The review is repeated regularly. Automated authorization tests run on every code change and confirm that one company's data is never visible to another, that department managers only see their own department and that deactivated users cannot get in. An independent penetration test has not yet taken place; when it does, a summary will be published here.

If you find a vulnerability in the service, we welcome a report at info@varhugi.is or at the address in the site's security.txt file at varhugi.is/.well-known/security.txt, and will respond quickly.

Subprocessors

Varhugi uses a small set of well-known subprocessors. Each receives only the data its service requires and is bound by a data processing agreement with Varhugi. Customers are notified of changes to this list 30 days in advance.

• VercelHosting and running the application and storing issued certificates, Frankfurt
• NeonDatabase, hosted in Frankfurt
• ResendSending email
• StripePayment processing when a subscription is paid
• UpstashCache for rate limiting and operational markers, hosted in Frankfurt