Your business data stays protected.

Encryption and account access

Data is protected in transit with TLS and encrypted at rest by our infrastructure providers. Supabase provides authentication and database infrastructure. Row-level access controls and server-side user and business filters help limit access to authorized records.

Connecting and disconnecting accounts

Plaid handles bank authentication; Varda does not receive or store your bank username or password. Plaid access tokens are stored server-side. Connected access is read-only: Varda cannot initiate transfers, send payments, or edit your bank accounts.

You can disconnect linked accounts in the app. Disconnection revokes the Plaid connection; removal of previously saved records depends on the deletion option you choose. Account deletion and retention are described in the Privacy Policy.

What information is used

Varda uses connected transaction dates, descriptions, vendors, categories, amounts, account names, types, and available balances, along with financial files, support messages, and feedback you choose to provide.

Varda does not request bank credentials, Social Security numbers, full bank account numbers, precise GPS location, or protected-class information. Avoid including unnecessary sensitive information in uploads or questions. We do not sell personal information or use transaction data for targeted advertising.

AI provider boundaries

Ask Varda is a request-and-response feature. Relevant structured business context may include summaries, vendor names, transaction descriptions, amounts, dates, categories, account display names or types, and alert details. Your question and conversation context may also be sent to OpenAI. Bank credentials, Plaid access tokens, and complete account numbers are excluded from the intended AI context; request filtering and redaction provide additional safeguards, not a guarantee that all sensitive text will be detected.

Varda does not use your financial data to train AI models. OpenAI does not use API inputs or outputs for training by default unless explicitly opted in. Requests use the API's non-storage setting; this does not eliminate provider abuse-monitoring retention. As disclosed in our Privacy Policy, prompts and responses may be retained for up to 30 days under standard API controls unless different controls apply.

Ask Varda cannot browse the open internet, run arbitrary code, move money, or independently resolve alerts or change records. Any supported record change requires your confirmation. Answers are not a substitute for professional accounting, tax, legal, or financial advice.

Conversations are saved in your Varda account and can be deleted from Ask Varda. Deletion from Varda does not immediately remove information already transmitted to OpenAI under its applicable retention policies. You can choose not to use Ask Varda.

Service providers

Varda uses Supabase for authentication and databases, Plaid for financial connections, Vercel for hosting, OpenAI for AI responses, PostHog and Sentry for analytics and error monitoring with sensitive-data controls, and Resend for service emails. See the Privacy Policy for data use, sharing, and retention.

Limitations, planned work, and incident reporting

No method of transmission or storage is completely secure. Varda records important system events and uses error monitoring to support investigation. Please report security concerns through our contact page so we can investigate and communicate with you.

Varda is not SOC 2 certified. Planned trust investments include multi-factor authentication options, formal vendor and access reviews, independent security testing, and potential SOC 2 readiness work. These are plans, not completed measures or certifications.