Security

Varuna is built as a portfolio tracker, not a broker or custodian. We do not hold your securities, execute trades, or store brokerage passwords. Our security work focuses on protecting account access, portfolio data, imports, billing records, and operational systems.

Authentication is handled through sign-in providers such as Google. Application routes check the signed-in user before returning portfolio data or accepting mutations.

Portfolio-scoped features, including email aliases, staged imports, transactions, categories, and settings, are designed so data belongs to a specific user and portfolio.

Uploaded documents and forwarded email attachments are stored in Cloudflare R2 while Varuna extracts transactions and gives you a chance to review the result. Stored objects are keyed by user and portfolio scope.

Document bytes are deleted when the import is committed or dismissed. Failed or abandoned imports are retained only for retry and recovery, then swept after the retention window, currently up to 30 days.

Portfolio import addresses are validated before any message is accepted. Unknown or disabled aliases are rejected. The Cloudflare Email Worker signs ingest requests, and the app verifies that signature before processing an email.

Email imports enforce size, attachment type, and quota limits. Sender authentication and trusted-sender checks are used to decide whether a message can be added automatically or should stay in review.

Paystack handles payment collection and payment method storage. Varuna stores subscription state, plan details, payment references, customer identifiers, and webhook records needed to keep your account entitlement in sync.

We use practical controls for a small product, including:

• Server-side validation for API inputs and imported data.
• Signed webhooks or ingest requests for payment and email workflows.
• Structured server logs for operational failures and abuse investigation.
• Scoped storage keys and database relationships for user-owned data.
• Best-effort cleanup and sweep jobs for temporary document objects.

Varuna depends on providers for hosting, database, object storage, email routing, market data, authentication, payments, and AI document extraction. We choose providers appropriate for the function they perform and limit what we send to what the feature requires.

• Protect the Google account or sign-in method you use for Varuna.
• Enable multi-factor authentication with your sign-in provider where possible.
• Review imported transactions before relying on them.
• Rotate or disable portfolio email aliases if one is exposed or no longer needed.
• Report suspicious account activity or unexpected imports quickly.

If you believe you found a security issue, email [email protected] with Security in the subject. Please include enough detail for us to reproduce the issue and avoid accessing data that does not belong to you.

Security is ongoing. Varuna is not currently represented as SOC 2, ISO 27001, or PCI certified. We do not guarantee that the service will be free from every vulnerability, interruption, third-party failure, or user mistake.