Security and trust
What the product enforces,not what it promises
The answers a security reviewer asks for first, written against how Varynt Knowledge is built. Where something is not available, it says so.
[ 01 ] Access
Who can read what
Enforced by the API
Every request is checked against the person's role and the space's and page's access. Hiding a button is never the control.
Restricted means admins too
A restricted space or page opens only to the people and groups named on it. A workspace admin who is not named cannot read it; recovering access is a separate action that is recorded.
Search and links respect it
A page you cannot open is not in your search results, and a link to it answers “not found”.
Staff only
Client-portal contacts of a Varynt Work workspace cannot open Knowledge. A page leaves the company only by a public link, which is off until an admin switches it on.
Files checked on every download
Images and files are kept in Knowledge's own storage, separate from the other Varynt products, and each download re-checks that you can still open the page.
Downloads you control
Let every reader export pages, or only admins; on Enterprise, stamp the reader's name, email and time on what they view and download.
[ 02 ] Sign-in
Getting in, and being kept out
One Varynt account
The same sign-in for every Varynt product your organization uses.
Two-step verification
Each person turns on an authenticator app from their own profile.
Sessions
Signed out after 30 minutes of inactivity; everyone signs in again after 10 hours however active.
IP allow-list
Limit the workspace to your networks; every Varynt product refuses requests from outside it.
Single sign-on (SAML or OIDC)Enterprise
Single sign-on through your own identity provider over SAML or OIDC (for example Okta, Microsoft Entra ID or Google Workspace). Your company's email domains, proven by a DNS record, sign in through it. On Enterprise.
SCIM provisioningEnterprise
Your directory adds, switches off and removes people and syncs groups across every Varynt product, only on your verified domains. New people get no access until a group or an admin gives it.
[ 03 ] Data and retention
What is kept, and for how long
Versions kept
The newest 50 versions of every page; older ones go as new ones are published. Under legal hold, every version stays.
Trash for 30 days
A deleted page can be restored for 30 days, then it is purged with its history, comments and files.
Page analytics for 400 days
Views per reader per day, then purged. Unanswered searches never record who searched.
Audit log
Admin and security actions are recorded on every plan. On Enterprise you can filter and export them and keep them from 90 days to 7 years (2 years by default).
Legal holdEnterprise
On Enterprise, a hold on a space or the workspace stops anything in it being destroyed until it is released.
Your content out
Any page to Word or Markdown; every page in one ZIP for workspace admins.
[ 04 ] Compliance
Where we stand
We operate under India's Digital Personal Data Protection Act; we are the processor for what your team writes, and you are the controller. The privacy policy names what we collect and the services we use to run Knowledge.
We do not claim a certification today. For a security questionnaire, write to contact-knowledge@varynt.in.