Security & data handling
Security, access and data-handling requirements for assessment and agreement before an engagement begins.
Last updated September 25, 2026
Security requirements and scope
Security planning should identify required information, relevant systems, authorised approvers and applicable client policies. Security and privacy requirements should be documented during the initial assessment of scope.
The following topics support that assessment. Specific controls, responsibilities and evidence must be agreed for the engagement; this page is not a certification or an assurance that a particular control has been implemented in your environment.
Access management
The access plan should name the people, systems, permissions and time period needed for the work. Consider individual accounts, least-privilege roles, multi-factor authentication (MFA), access logs and a process for approving or removing access.
Where required, specify the client-approved VPN or virtual desktop, device encryption, credential manager and restrictions on downloads, clipboard use and local copies. These controls depend on the agreed environment and should be verified before access is granted. Do not send credentials through the enquiry form.
Data location and remote access
Hosting data in a US cloud region does not, by itself, restrict where people can view or process it. Remote access, logs, backups, email and third-party services also need to be included in a location and transfer review.
If your project requires US-only storage or access, identify both requirements during scoping. The agreement should specify permitted hosting regions, access countries, approved providers and any required transfer arrangements. Confirm feasibility before sharing restricted data.
Data minimisation
Plan around synthetic or appropriately de-identified data where possible. Removing a name does not necessarily anonymise a dataset; review identifiers, combinations of attributes and the possibility of re-identification.
Before production data is used, agree its purpose, permitted recipients, encryption requirements and handling restrictions. Any AI service needs a separate review of the information sent to it, retention and training settings, access controls and human review requirements.
Contractual responsibilities
Confidentiality, ownership, permitted data use and delivery responsibilities belong in the engagement documents. Where personal information is involved, determine the parties’ roles and whether a data-processing agreement, provider approvals or transfer terms are required.
Applicable requirements, including GDPR or California privacy requirements, should be included in that review. An individual project’s legal obligations and technical configuration need their own assessment. A cloud provider’s certification does not certify Varveta or the completed solution.
Incident management and access termination
Agree the incident contacts, escalation steps, notification requirements and responsibility for investigation before work starts. Response times and support coverage must be set in the engagement terms.
The handover plan should cover code and documentation, account removal, credential rotation, and return or deletion of project information. Identify backup retention and any legal retention exceptions; agree what evidence of completion is needed.
Website data handling
The public enquiry form is for business contact details and initial project context. It has no file-upload field. The server validates required fields and length limits, checks permission to respond, and uses a hidden field to filter basic automated submissions. When configured, Resend sends the enquiry to our email inbox.
Website demonstrations use fictional data and scripted interactions. They do not connect to your systems or send your data to an AI service. Read the Privacy policy for website analytics, service providers and privacy requests. For a security concern, email contact@varveta.com with a description and non-sensitive reproduction steps.
Contact information
Contact contact@varveta.com for enquiries regarding this policy or its application.