How Varcio handles your data

Primary region

AWS ap-south-1 (Mumbai, India)

Application, database, cache, object storage and encryption keys.

Database

Amazon RDS PostgreSQL, single-AZ

Encrypted at rest; automated backups with point-in-time recovery.

Backups

7-day point-in-time recovery

Retained in-region. Deleted data can remain in backups for up to 7 days.

Encryption at rest

AES-256

The database and object storage are encrypted with a customer-managed AWS KMS key in Mumbai, and the cache is encrypted at rest. Credentials and integration secrets are additionally wrapped per record with the same key (envelope encryption).

Encryption in transit

TLS 1.2 or later

TLS 1.0 and 1.1 are refused. HSTS is sent on every public hostname. The link to the cache is TLS-encrypted too.

Tenant isolation

Workspace-scoped at query level

Enforced in storage and query paths, not only in the UI. The only cross-workspace reads are the aggregate FinOps-score percentile (at least five peers) and the opt-in benchmark network.

Encryption keys

Mode

Envelope encryption with per-record data keys

Key wrapping

Customer-managed AWS KMS key (ap-south-1) wraps the data keys for credentials and integration secrets

Database and object storage

Encrypted with the same customer-managed AWS KMS key (ap-south-1)

India: DPDP Act 2023

• The Act imposes no general data-localisation duty on ordinary data fiduciaries. Two provisions can require India residency: Rule 13(4), for Significant Data Fiduciaries and only for data the Government specifies (no list or designation has been published), and Section 16(2), which preserves stricter sector rules.
• RBI's 2018 payment-data circular applies to authorised payment systems and listed banks, and reaches their vendors through them. This platform stores no card, bank-account or payment-credential data; Stripe and Razorpay hold it.
• Customers regulated by SEBI, or buying under government cloud-procurement rules, can be required to use India-resident, MeitY-empanelled hosting; banks, NBFCs and insurers usually require a data-location clause by contract. Hosting in Mumbai meets an India-residency requirement; whether a given hosting provider is MeitY-empanelled is a separate procurement check that depends on the buyer's rules.
• There is no EU data residency option today, and customers cannot choose a region. Every customer is served from Mumbai, India; AI inference moves back to Mumbai once AWS raises the Bedrock capacity there.

How a cloud connection is handled

1. 1

   Encrypt on ingest

   Credentials and integration secrets are encrypted before they are persisted.

2. 2

   Validate read plane

   Provider read access is verified before any telemetry or compliance processing runs.

3. 3

   Gate write plane

   Write actions stay blocked until permissions and approval requirements are satisfied.

4. 4

   Audit and retain

   Sensitive operations are logged, and audit entries are kept for your plan's retention window.

Incident response and vulnerability reports

• Severity is triaged within 15 minutes.
• First public update within 30 minutes for SEV-1 and SEV-2.
• Updates every 30 minutes until the incident is stable.
• The closure update states the root cause, the remediation and the prevention actions.
• A postmortem is completed within 5 business days for SEV-1 and SEV-2.

Report a vulnerability to the security contact with reproduction steps, impact and the affected component. We acknowledge within 1 business day and triage severity within 3 business days. Report a vulnerability. Security research is authorized when performed in good faith and without data exfiltration, service disruption or privacy violations.

Closing an organization

1. 1

   Request

   An organization administrator types the organization name, gives a reason and re-authenticates. Every administrator is emailed.

2. 2

   Export window

   Nothing is deleted for 30 days and any administrator can cancel. Billing stops: the subscription does not renew while the request stands.

3. 3

   Purge

   The organization's database records and uploaded files are deleted, and a permanent purge record is kept. The requester is emailed its reference.

Integrations you turn on

These receive data only when your organization connects them, with credentials you supply.

What the AI assistant sends to a model

Every plan uses AWS Bedrock. Model calls run in us-east-1 (United States) until AWS raises Bedrock capacity in Mumbai; nothing is stored there, and no other model provider is used. Knowledge-base search is embedded inside the platform, and outside web research is switched off.

Always sent

User message, System instructions

Sent when relevant to the question

Workspace snapshot, Memory context, Knowledge snippets, Custom instructions

Sender address

no-reply@varcio.com

This address does not take support requests. Contact support from inside the product.

Authentication

DKIM (2048-bit), SPF-aligned, DMARC

Messages are signed by varcio.com; DMARC is published for the domain.

Sent through

Amazon SES, Mumbai (ap-south-1)

Microsoft 365 is used only as a fallback if SES cannot deliver a message.

Transport security

TLS when the receiving server supports it

Delivery is encrypted in transit whenever your mail server offers TLS.

IP addresses

Shared, not fixed

Allow-list the domain and its DKIM signature, not addresses. If your policy requires fixed IPs, contact us.

For your IT team

• Allow mail from the domain varcio.com that passes DKIM (d=varcio.com).
• Do not rely on IP allow-lists: the sending addresses change as the provider scales.
• If a message is quarantined, release it and report it to support so the cause can be traced.

How we handle delivery problems

• Addresses that bounce permanently, or whose owner marks a message as spam, are stopped automatically and flagged to your administrators in Members, so an invitation to a mistyped address does not fail silently.
• Security alerts, sign-in codes, approval requests and support replies are always sent. Optional notifications carry a one-click unsubscribe link and follow each person's notification preferences.

Known limitations

Stated plainly so a reviewer does not have to ask.

• No third-party penetration test report exists yet. The programme is defined.
• No VPAT or independent accessibility audit is published. The product is designed to WCAG 2.2 level AA.
• Customers cannot choose a data region. Every customer is served from the region shown above.
• The database is single-AZ with 7-day point-in-time recovery. There is no cross-region recovery.
• Legal hold is not supported.
• Audit-log streaming to a SIEM is not yet available. Audit logs can be exported as CSV or JSON.
• The standard Data Processing Agreement is published and applies to all customers. Customers with specific requirements can ask for changes, which we review with counsel.

Accessibility

We design to WCAG 2.2 level AA. The product has not yet been audited independently, and we do not publish a VPAT. If something stops you using Varcio with assistive technology, email support@varcio.com and we will treat it as a defect.

Commitment

99.9% monthly uptime

Paid plans. Preview, beta and sandbox environments are not covered.

What counts as downtime

Minutes when the production API or web control plane is unavailable to all customer tenants because of a failure of the service.

Request a credit within 30 days after the month, with your organization and the incident times. Credits apply to future invoices. Include your organization identifier, the incident timestamps in UTC, the affected endpoints or workflows. We review platform telemetry and incident records and respond within 10 business days.

Exclusions

• Customer-side misconfiguration, credential revocation or IAM policy changes
• Outages of a third-party cloud provider (AWS, Azure, Google Cloud) outside our control
• Customer network problems, ISP failures, or browser and device faults
• Force majeure
• Suspension or rate limits applied for abuse, non-payment or a terms violation

Support response targets

• Data retention and deletion

  Retention windows per data class and the deletion path on termination.

  Updated September 15, 2026

• Incident response plan

  Severity classification, escalation, and customer notification timelines.

  Updated September 29, 2026

• Personal data breach response

  How a personal-data breach is contained, reported to CERT-In within six hours, and notified to customers, the Data Protection Board and affected people.

  Updated September 29, 2026

• Grievance and data-rights procedure

  How privacy requests and complaints are received, verified, answered and escalated, with timelines.

  Updated September 29, 2026

• DPDP and India compliance map

  Each requirement of India's data-protection law, CERT-In and sector rules, how it is met, and its honest status.

  Updated September 29, 2026

• Change management

  Review, approval and rollback requirements for production change.

  Updated February 26, 2026

• Vulnerability disclosure

  How to report a vulnerability and what response to expect.

  Updated February 26, 2026

• Penetration test programme

  Testing scope, cadence, and how findings are tracked to closure.

  Updated February 26, 2026

• Uptime SLA

  Availability commitment, measurement and service credits.

  Updated February 22, 2026

Position statement for security review, not legal advice. If a signed order form, MSA or DPA exists, it controls over this page to the extent of any conflict.