Home / Security
Security and deployment
Updated 1 November 2026
Vardion runs on your own server or on our hosted console, on EU servers.
Deployment
- One Docker service on a Linux server, with its database inside the container on a local socket, so Vardion holds no database password.
- The console is bound to the loopback address. Published, it sits behind the bundled Caddy with automatic HTTPS.
- The hosted console runs no active scans; your own installation does.
Data
- Your records stay on your server or in your own workspace on the hosted console.
- API keys and webhook addresses are never displayed, logged or exported.
- A credential found by a scan is never stored, only where it was found. STIX and MISP carry evidence only when an export asks.
- The console's pages load no third-party scripts, fonts or images.
Export and continuity
- Export your data at any time as CSV, JSON, XLSX, STIX 2.1 or the ΕΑΚ's own formats.
- An installation on your own server needs no licence key or connection to Vardion, so it keeps running whatever happens to Vardion.
- If we stop the hosted console, we tell you at least 90 days before and hand you a full export that loads into your own installation.
Scanning safeguards
- An address is scanned only after it is approved, or when it sits in a range or cloud account declared as yours.
- Private addresses are never included in an internet-facing scan.
- Scans leave out denial-of-service, intrusive and fuzzing checks and send at most 50 vulnerability-check requests a second per host by default.
- Widening the scope needs a typed confirmation of the exact change and is audited.
Outbound connections
| Destination | Purpose | When |
|---|---|---|
| Approved addresses | Port, service, certificate, web and vulnerability scans | Each scan |
| Discovery sources used by subfinder, and crt.sh | Names under the scope domains, lookalike domains and new certificates | Each discovery run, passive check and supplier watch |
| XposedOrNot and Hudson Rock | Leaked credentials for the scope domains (the domain is sent, never an address or a password) | Each passive check |
| IANA | The RDAP bootstrap file that names each registry | Passive DNS check |
| DNS resolvers and Team Cymru's DNS service | Name resolution and the network owner of each address | Discovery and passive checks |
| Domain registries over RDAP | Registration expiry, registrar and transfer lock | Passive DNS check |
| CISA, ENISA, OSV, NVD and MITRE D3FEND | Known exploited vulnerabilities, EUVD identifiers, package vulnerabilities and the countermeasure catalogue's release | Daily while enabled, or on request |
| Wordfence Intelligence | The whole feed of WordPress plugin and theme vulnerabilities, matched inside Vardion (nothing about you is sent) | Daily, once a key is set |
| GitHub, PyPI and the ZAP project | Scanner release check | Daily while enabled, or on request |
| Shodan, Have I Been Pwned, WhoisXML and RIPEstat | Related assets and leaked credentials | Only with a key configured, or on request |
| GitHub and GitLab | Lockfiles in the repositories you connect, read with a read-only token | Each repository check |
| GitHub code search | Public code that names your domains or brand terms (the search terms are sent) | Each passive check, with a GitHub token configured |
| Amazon S3, Google Cloud Storage and Azure Blob Storage | Whether storage named after your brand is public | Each passive check, when switched on |
| CertStream | New certificates for names like yours, as they are logged | While the live certificate watch is switched on |
| Certificate transparency logs | New certificates for your domains and brand names, read from the logs directly | While the own certificate monitor is switched on |
| The Greek business registry (ΓΕΜΗ open data) | Status and registered name of each supplier with an ΑΦΜ (the ΑΦΜ is sent) | Monthly per supplier, only with a ΓΕΜΗ key configured |
| ΑΑΔΕ's business registry lookup, with your own access codes | Tax standing of a supplier with an ΑΦΜ (the ΑΦΜ is sent) | Only when a person asks, once the platform owner turns it on and your codes are set |
| Your DMARC report mailbox | DMARC aggregate reports, read without changing the mailbox | Every six hours, only when you set it up |
| Your exposed data stores | Samples of files, public buckets and approved databases a finding shows to be yours, counted for personal data and never kept | Daily, only when you turn content checks on |
| Your webhook addresses | Signed events about findings, deadlines, evidence, incidents and scans, never evidence itself, over https to a public address | Only when you add a webhook |
| The integrations you connect | Alerts, tickets, SIEM events, cloud and identity reviews, staff lists, vulnerability imports and mail | Only when connected |
Our own grade
Checked monthly by our free domain check.
| Domain | Grade | Checked |
|---|---|---|
| getvardion.com | B | 4 November 2026 |
| check.getvardion.com | A | 4 November 2026 |
Reporting a vulnerability
Write to support@getvardion.com, also published in security.txt. The Cyber Resilience Act statement sets out how each report is handled.
Questions from your security review
Is our data encrypted?
In transit: HTTPS only, and mail over TLS or STARTTLS. Each workspace is encrypted with its own AES-256-GCM key, kept out of every backup: on the hosted console always, and on your own server with one setting. Passwords are kept as scrypt hashes and access tokens only as SHA-256.
How is it backed up?
Daily, with a restore tested every month, on the hosted console and on your own server, where each archive is also encrypted for your offsite copy. One command restores it.
Where is it hosted, and who processes it?
The hosted console runs on OVHcloud servers in the EU. The data processing agreement names every subprocessor with its purpose and location, and we email you 30 days before adding one.
Who at Vardion can see our data?
Nobody, until your administrator grants support access for set hours, read-only if they wish. For a security incident or a legal order Vardion can open a workspace without a grant, and your administrators are emailed at once. Every page opened is in a log you can export.
How long do you keep it, and how is it deleted?
While the agreement runs. Nothing is purged until your administrator sets retention. At the end you get a full export and the data is deleted within 30 days, confirmed in writing.
Who is responsible for what?
Hosted: Vardion runs the server, its updates and HTTPS. You manage accounts, roles, scope and uploads. On your own server you run the server, its access and its backups. Vardion supplies security fixes and signed releases, each with its SBOM.
What is logged, and who can do what?
Five roles from viewer to owner, each limited to its workspaces. Changes to scope, settings, approvals and accounts go to a hash-chained audit log. Sessions end after 12 idle hours or 7 days. Two-step verification, SSO and SCIM are built in.
Send us your questionnaire
We answer it, or show you the deployment in a demo.