Security and vulnerability disclosure

Email support@varaxontech.com with "Security" in the subject. Describe the issue and the page or API involved. Please don't send exploit code or anyone's scan data in the first email; we'll reply with a way to share details.

We acknowledge reports within 3 business days, tell you whether we can reproduce the issue, and keep you updated until it is fixed. We're happy to credit you once the fix is live, if you want that.

If you follow these rules, we will not pursue legal action against you for your research:

• Test only with accounts you created yourself, and never read, change or delete other customers' data.
• Stop and tell us as soon as you see data that isn't yours.
• No denial-of-service, load testing, spam, social engineering or physical attacks.
• Don't upload real client scan data to test accounts.
• Give us a reasonable time to fix an issue before telling anyone else.

In scope: scan.varaxontech.com, its upload API, and varaxontech.com. Out of scope: services run by our providers (Supabase, Stripe, Microsoft, Cloudflare and others), which have their own programs. We don't offer paid bounties.

Every user must pass multi-factor sign-in before the database returns any customer data, and row-level security keeps each organization's data separate. Data is stored in the United States and encrypted in transit and at rest. Raw uploads are deleted within 7 days. Scan Hub pseudonymizes scan data before sending it to its AI models, and nobody trains AI models on it.

The Data Processing Addendum lists our security measures and every subprocessor, and the Privacy Policy explains what we collect. Varaxon does not hold a SOC 2 report or ISO 27001 certificate. We are glad to complete your security questionnaire: email support@varaxontech.com.