Security and trust
Your customers' details,kept where they belong.
A front desk holds names, phone numbers and appointments. This page says how Desk protects them, in plain terms, with nothing on it that the product does not do today.
Access
Everyone sees only their part.
Five roles, 39 capabilities
Owner, admin, manager, agent and viewer, each a set of capabilities the server checks on every request, not a menu that is merely hidden.
Branch scoping
An agent assigned to one location cannot read, hold or book at another.
Personal fields masked
Fields marked personal in your Blueprint are masked in exports for anyone without permission to see them in full.
Activity log
Who changed what and when, kept for 180 days by default and never edited.
Sign-in
One Varynt account, protected properly.
Two-step sign-in
A six-digit code from any authenticator app on top of the password, for each person who turns it on.
Signed out when idle
A session left alone for 30 minutes ends, with a warning first.
IP allow-list
Owners and admins can limit the team to up to 50 office or VPN networks. Customer booking pages stay reachable.
Single sign-on (SAML or OIDC) on Enterprise
Sign in through your own identity provider over SAML or OIDC, such as Okta, Microsoft Entra ID or Google Workspace. Your email domains, proven by a DNS record, go straight to it.
SCIM provisioning on Enterprise
Your identity provider adds, switches off and removes people and syncs groups, across every Varynt product. New people get no access until a group or an admin gives it, and synced groups stay read-only in Varynt.
Help when locked out
An owner or admin can reset a colleague's second step; nobody needs to share a password.
Data
Yours, separate, and portable.
Workspace isolation
Every request is checked against the workspace it belongs to; a valid sign-in for one workspace cannot read another's. Covered by automated tests.
Export everything
Owners and admins can download the whole workspace as a zip of CSV files at any time: one row per thing that happened, with the ids that join them.
Do not contact, honoured
A contact marked do-not-contact is left out of messages and recall lists.
Not shared, not mined
We process your desk's data to run your desk and for nothing else. It is never used for marketing or shared with other Varynt products unless you connect one.
When you leave
Thirty days after the agreement ends the workspace is deleted, as the Terms of use set out.
Platform
Careful in the parts you never see.
Encrypted in transit
Every page and API call is served over HTTPS, with strict transport security.
Strict browser policies
A content security policy that allows nothing from outside our own origin, plus the standard protective headers.
Rate limits
Public pages and sign-in paths are rate limited, so a script cannot hammer them.
Signed customer links
Reschedule and cancel links in emails are signed and expire; a forged or altered link is refused.
No code in configuration
Blueprint conditions and formulas are a closed rule language interpreted by Desk, never code that runs. Every Blueprint is validated before it is stored.
Mail that is not lost
Every email is logged before it is sent and retried if the relay is down; managers are told about a send that keeps failing.
Compliance
What we answer to.
India's Digital Personal Data Protection Act is the regime we work under. For your team's accounts we are the controller; for the customers your desk records, you are the controller and we process their data on your instructions. The privacy policy sets out what is held, why and for how long.
We will list third-party certifications and audit reports here when we hold them. Security questionnaires from procurement teams are welcome: write to desk-contact@varynt.in.