# Varanic

Credit monitoring platform

Research: https://www.safecli.org/company/varanic.ai
Company: https://varanic.ai

## Evidence status

Procurement review needed
Source review: 2026-10-16T03:30:25.077Z
API: API mentioned

Company-published claims, not independently verified controls. Unknown is not evidence of absence.

## Procurement checks

### Security assurance — Mixed claims — review

> Varanic completed a SOC 2 Type 2 examination with Sensiba LLP in July 2026, covering the design and operating effectiveness of our Security controls over a three-month observation period.

Source: https://varanic.ai/
Reviewed: 2026-10-16T03:30:25.077Z

> This follows our SOC 2 Type 1 attestation from May 2026.

Source: https://varanic.ai/
Reviewed: 2026-10-16T03:30:25.077Z

> SOC 2 Type 2 Attestation Letter Sensiba July 2026 Sensiba LLP confirmation of attestation issuance (no NDA required) Request Access → (security@varanic.ai?subject=Request%20Access%3A%20SOC%202%20Type%202%20Attestation%20Letter&body=Hi%20Varanic%20Security%20Team%2C%0A%0AI%20would%20like%20to%20request%20access%20to%20the%20SOC%202%20Type%202%20Attestation%20Letter%20(Sensiba%20July%202026).%0A%0ACompany%3A%20%0AName%3A%20%0ARole%3A%20%0A%0AThank%20you.)

Source: https://varanic.ai/security
Reviewed: 2026-10-16T03:30:25.077Z

> SOC 2 Type 1 Attestation Letter Sensiba 6 May 2026 Sensiba LLP confirmation of attestation issuance (no NDA required) Request Access → (security@varanic.ai?subject=Request%20Access%3A%20SOC%202%20Type%201%20Attestation%20Letter&body=Hi%20Varanic%20Security%20Team%2C%0A%0AI%20would%20like%20to%20request%20access%20to%20the%20SOC%202%20Type%201%20Attestation%20Letter%20(Sensiba%206%20May%202026).%0A%0ACompany%3A%20%0AName%3A%20%0ARole%3A%20%0A%0AThank%20you.)

Source: https://varanic.ai/security
Reviewed: 2026-10-16T03:30:25.077Z

- [ ] Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### SSO & provisioning — Not found


- [ ] Test SSO enforcement, user removal and privileged-account recovery.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Access controls — Company-published

> Multi-tenant isolation on every database row.

Source: https://varanic.ai/
Reviewed: 2026-10-16T03:30:25.077Z

> MFA support with TOTP authentication, role-based access control, and append-only audit trails.

Source: https://varanic.ai/
Reviewed: 2026-10-16T03:30:25.077Z

- [ ] Test least-privilege roles and cross-tenant access with separate test accounts.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Auditability — Company-published

> ### Audit Trail & Compliance

Source: https://varanic.ai/
Reviewed: 2026-10-16T03:30:25.077Z

> MFA support with TOTP authentication, role-based access control, and append-only audit trails.

Source: https://varanic.ai/
Reviewed: 2026-10-16T03:30:25.077Z

- [ ] Verify administrative and data-access events, retention and export.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Data handling — Mixed claims — review

> AES-256 TLS 1.2+ DPA Available

Source: https://varanic.ai/
Reviewed: 2026-10-16T03:30:25.077Z

> - Configurable data retention policies with full customer control

Source: https://varanic.ai/security
Reviewed: 2026-10-16T03:30:25.077Z

> The purpose of this DPA is to ensure that the processing of Personal Data by the Processor on behalf of the Controller is carried out in compliance with applicable data protection laws and regulations, including but not limited to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the California Consumer Privacy Act ("CCPA"), and other applicable privacy legislation.

Source: https://varanic.ai/dpa
Reviewed: 2026-10-16T03:30:25.077Z

> - Breach Notification: Notify the Controller without undue delay after becoming aware of a personal data breach, as further described in Section 9 of this DPA.

Source: https://varanic.ai/dpa
Reviewed: 2026-10-16T03:30:25.077Z

- [ ] Review DPA, subprocessors, retention, deletion, residency and AI training use.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Reliability & support — Company-published

> - Security incident response plan documented with severity levels, escalation paths, and notification timelines

Source: https://varanic.ai/security
Reviewed: 2026-10-16T03:30:25.077Z

- [ ] Request SLA, incident history, recovery targets and support escalation terms.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Product effectiveness — Not found


- [ ] Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

## Decision

- Owner:
- Intended use and data sensitivity:
- Blocking requirements:
- Pilot success criteria:
- Unresolved risks:
- Decision and review date: