Security and Service Assurance

1. Technical and Organisational Measures

• TLS-encrypted communication in transit; encryption at rest at our hosting providers
• Row-level security (RLS) isolating data per user/workspace; server-side authorisation checks against unauthorised access
• Private storage buckets and time-limited signed links
• Automated abuse protection with Cloudflare Turnstile, IP/email-based rate limiting and fraud signals
• Multi-factor authentication (TOTP) support; once enabled, the second step is mandatory
• Error monitoring (configured not to send personal data) and security event logs
• Least-privilege access; service keys are held server-side only

2. Personal Data Breach Notification

If personal data is unlawfully obtained by others: in Türkiye we notify the Personal Data Protection Board as soon as possible and within 72 hours under KVKK Art. 12; under the GDPR we notify the competent supervisory authority within 72 hours of becoming aware. If the breach is likely to result in a high risk we inform affected persons without undue delay in plain language.

Breaches, their effects and the measures taken are recorded in an internal register.

3. Security Together

Because no online system is entirely risk-free, security is a shared effort. We recommend using a strong, unique password, enabling multi-factor authentication, reviewing workspace permissions regularly and reporting anything suspicious immediately.

4. Reporting a Vulnerability

If you find a vulnerability, report it to contact@varnevo.com. We will not take legal action against good-faith researchers who follow responsible disclosure; unauthorised access to data, disrupting the service and disclosing user data are outside this protection.

5. Availability Target

We target at least 99.5% monthly availability and monitor errors continuously. Planned maintenance is announced in-app beforehand where possible and we aim to schedule it at low-usage times. Pre-announced planned maintenance, force majeure and third-party infrastructure outages beyond our control are excluded. These values are our service targets and do not limit consumers' statutory rights.

6. Support

Send support requests to contact@varnevo.com; we aim to give a first response within 2 business days. Use contact@varnevo.com for security reports; these are prioritised.

7. Outage Remedy

If, for reasons attributable to us, the service is continuously and materially not provided in conformity with the contract, upon your notice we refund or credit against your next invoice a proportionate part of that period's fee. Consumers' statutory rights regarding defective services are also reserved.