Skip to content

Security one-pager

For your security team: what our scanner touches, what we store, and how to switch us off.

Last updated 13 October 2026.

What the scanner does

Read-only. A headless Chromium visits the public pages the crawl finds from your homepage, and the areas behind sign-in that you tick on the Scope page. It follows links, presses Tab, and replays the recordings you import. It submits no forms except the sign-in form, with the test account you gave us, and the steps of your recordings.

Rate-limited and identified. Every request carries the user agent VariantlyScanner/0.1 (+https://variantly.app/security; read-only, rate-limited), which links to this page. If your bot protection challenges us, the scan stops and says so, and nothing is charged for a blocked attempt. Allow-listing our scanner or giving us a test account resolves it.

The test account

Give us a non-production or seeded account with the least access that still shows the product. Its password is sealed with AES-256-GCM under a key held only by the worker process, is never displayed to anyone, and is used only to sign in for a scan. Revoke our access by deleting the account, or by removing it on the Scope page; the sealed credential is deleted with it.

What we store

Captures of your product's pages: screenshots, accessibility trees, virtual screen-reader transcripts (read from the accessibility tree), focus traces, rule output, and short videos of recording replays, stored by content hash in private object storage. Captures that a published report rests on are copied to a kept bucket and stay for the life of that version. The scanner signs in with a seeded test account, which should contain no production customer data. Variantly does not need access to your customers' accounts.

Account and billing records in Postgres. Card details go to Stripe and never reach us.

Where it runs

The web app, the worker with its browser, Postgres, object storage and email each run with a managed provider. The AI tier is Anthropic, which receives captured page evidence for the rows it proposes, and OpenAI, which receives the screenshots and page text of a task review's attempts. To plan a scan, choosing which pages to capture and which controls to try, the AI tier sends page titles, paths, link and control labels and roles, and cropped screenshots of captured pages to either provider. OpenAI handles all of it on its standard API terms: no training on it, abuse-monitoring retention of up to about thirty days, and nothing stored beyond that. Neither receives the test account. The current providers:

  • Vercel: the web app, Washington, D.C. (iad1).
  • Fly.io: the worker and its browser, Virginia (iad).
  • Neon: Postgres, AWS US East 1 (N. Virginia).
  • Cloudflare R2: captures and report files.
  • Resend: email.
  • WorkOS: sign-in.
  • Stripe: payments.
  • PostHog: product analytics, United States.
  • Sentry: error reports.
  • Crisp IM SAS: support chat where available, core infrastructure in Amsterdam, Netherlands. See its privacy policy for subprocessors and transfers.
  • Slack: support notifications and conversation copies through our existing Crisp integration, while its paid-plan entitlement is active.
  • Anthropic: the AI tier.
  • OpenAI: the AI tier, task reviews and scan planning.

The scanner's address range for allow-listing is available from security@variantly.app. This list changes here when a provider does.

Support chat

Where chat is available, Crisp loads only when you open Contact us. It runs in our support document on the dashboard host. We do not automatically send account details, product evidence or the page you opened chat from. Messages and files you submit go to Crisp. The embedded document limits the context we send; third-party code on the dashboard host can still access a signed-in parent page. Public company and report pages do not load chat. Camera and microphone access are disabled in the support document.

Access, transport and retention

TLS everywhere. Secrets live in the host's secret store, and the single sealed-secret key is rotated on request. Access to production is limited to the founders and logged. Nightly captures that no report rests on are deleted after ninety days; everything else follows the privacy policy. Deletion on request within thirty days.

Incidents and contact

Report a vulnerability or an incident to security@variantly.app. We acknowledge within one business day, and we tell affected customers of a confirmed breach without undue delay, and within seventy-two hours where the GDPR applies.

security.txt

For anything else, write to hello@variantly.app. We reply within one business day. Requests to delete or export your data go to privacy@variantly.app, as the privacy policy says, and are answered within thirty days.