Security at Variask

• Variask runs on high performance servers, with data stored in a secure, managed database.
• All traffic to Variask uses HTTPS.
• Each customer's brands, prompts and results are kept separate and are only shown to people in that customer's account.

• Passwords are stored only as salted bcrypt hashes, never in plain text.
• Sign in sessions use secure, HTTP only cookies.
• New accounts confirm their email with a one time code.
• Password reset links expire after one hour and stop working once the password changes.
• Team owners decide who is invited to their account.

• Tokens for connected apps, such as Google, are encrypted with AES-256-GCM before they are stored.
• API keys are shown once when created and stored only as a hash. You can revoke a key at any time.

Payments are handled by Dodo Payments, our merchant of record. Card details are entered on their checkout and never touch or get stored on Variask servers.

To check AI answers, Variask sends your tracked prompts to AI engines. We only route requests to providers that do not store or train on those prompts, where the engine offers that choice. We do not send your account details with them.

If you find a security problem, please write to support@variask.com with the details. We look into every report. See our privacy policy for how we handle personal data.