Varanic

Credit monitoring platform

Enterprise evidence

Procurement review needed

Public information covers access controls, auditability, reliability & support. Still unresolved: security assurance, sso & provisioning, data handling.

4 official sources · Fresh page review · Not independently tested

Sources reviewed 2026-10-16

3 / 7 areas with published evidence · 0 independently verified

Evidence & checks

Security assuranceMixed claims — review

Varanic completed a SOC 2 Type 2 examination with Sensiba LLP in July 2026, covering the design and operating effectiveness of our Security controls over a three-month observation period.Reviewed 2026-10-16View source

This follows our SOC 2 Type 1 attestation from May 2026.Reviewed 2026-10-16View source

SOC 2 Type 2 Attestation Letter Sensiba July 2026 Sensiba LLP confirmation of attestation issuance (no NDA required) Request Access → (security@varanic.ai?subject=Request%20Access%3A%20SOC%202%20Type%202%20Attestation%20Letter&body=Hi%20Varanic%20Security%20Team%2C%0A%0AI%20would%20like%20to%20request%20access%20to%20the%20SOC%202%20Type%202%20Attestation%20Letter%20(Sensiba%20July%202026).%0A%0ACompany%3A%20%0AName%3A%20%0ARole%3A%20%0A%0AThank%20you.)Reviewed 2026-10-16View source

SOC 2 Type 1 Attestation Letter Sensiba 6 May 2026 Sensiba LLP confirmation of attestation issuance (no NDA required) Request Access → (security@varanic.ai?subject=Request%20Access%3A%20SOC%202%20Type%201%20Attestation%20Letter&body=Hi%20Varanic%20Security%20Team%2C%0A%0AI%20would%20like%20to%20request%20access%20to%20the%20SOC%202%20Type%201%20Attestation%20Letter%20(Sensiba%206%20May%202026).%0A%0ACompany%3A%20%0AName%3A%20%0ARole%3A%20%0A%0AThank%20you.)Reviewed 2026-10-16View source

Before relying on it
Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.

SSO & provisioningNot found

Before relying on it
Test SSO enforcement, user removal and privileged-account recovery.

Access controlsCompany-published

Multi-tenant isolation on every database row.Reviewed 2026-10-16View source

MFA support with TOTP authentication, role-based access control, and append-only audit trails.Reviewed 2026-10-16View source

Before relying on it
Test least-privilege roles and cross-tenant access with separate test accounts.

AuditabilityCompany-published

### Audit Trail & ComplianceReviewed 2026-10-16View source

MFA support with TOTP authentication, role-based access control, and append-only audit trails.Reviewed 2026-10-16View source

Before relying on it
Verify administrative and data-access events, retention and export.

Data handlingMixed claims — review

AES-256 TLS 1.2+ DPA AvailableReviewed 2026-10-16View source

- Configurable data retention policies with full customer controlReviewed 2026-10-16View source

The purpose of this DPA is to ensure that the processing of Personal Data by the Processor on behalf of the Controller is carried out in compliance with applicable data protection laws and regulations, including but not limited to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the California Consumer Privacy Act ("CCPA"), and other applicable privacy legislation.Reviewed 2026-10-16View source

- Breach Notification: Notify the Controller without undue delay after becoming aware of a personal data breach, as further described in Section 9 of this DPA.Reviewed 2026-10-16View source

Before relying on it
Review DPA, subprocessors, retention, deletion, residency and AI training use.

Reliability & supportCompany-published

- Security incident response plan documented with severity levels, escalation paths, and notification timelinesReviewed 2026-10-16View source

Before relying on it
Request SLA, incident history, recovery targets and support escalation terms.

Product effectivenessNot found

Before relying on it
Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.

Published claims are not verified controls. No hands-on performance or security testing has been performed.

What we know

Varanic extracts terms from credit agreements and compliance certificates, tracks headroom, and flags breaches with a human-in-the-loop verification model.

Worth asking

How does their human-in-the-loop verification scale during rapid portfolio growth?

Sources

Evidence details

Enterprise controls

Varanic completed a SOC 2 Type 2 examination with Sensiba LLP in July 2026, covering the design and operating effectiveness of our Security controls over a three-month observation period SOC 2 Type 2 SOC 2 Type 1 ### SOC 2 Type 2

Developer access

- Multi-tenant isolation: every database row scoped to account_id with rigorous controls to prevent cross-tenant data access - Role-Based Access Control (RBAC) with admin, user, and viewer roles enforcing granular permissions - MFA support with TOTP-based authentication and configurable device trust policies - Session-based authentication with secure token management and automatic expiration - Input validation on API endpoints; expanding sanitization coverage across all routes - API key authentication required for all programmatic access - Rate limiting on all endpoints to prevent abuse and ensure availability - HTTPS-only access to production; HTTP requests are redirected to HTTPS at the Cloudflare edge - Request validation and content-type enforcement on API calls - Rate Limiting: API and endpoint rate limiting is implemented to prevent abuse, brute-force attacks, and denial of service attempts

Last checked Oct 16, 2026

Company-published evidence, not an independent audit. Unknown means unverified.