Permissions are enforced by the database
Who may read what is checked by row-level rules in PostgreSQL on every request, before any text is retrieved. No prompt, model or plugin decides access.
Security
Security that doesn't depend on a model behaving.
In Varro, permissions are decided by code and the database before anything reaches an AI. These are the rules we hold ourselves to, and the path every request takes.
The path of a request
From your question to your cluster, and nowhere else.
Signing in happens on your cluster. The shared address only decides which cluster a request belongs to; it never issues sessions or stores your data.
Your cluster connects out to Cloudflare through an encrypted tunnel. Nothing on it accepts connections from the internet.
Every request is signed for your company alone, and the cluster rejects anything unsigned before it reaches a single document.
Our rules
Eight rules, enforced in code.
Each one is tested against a real database on every release. A change that breaks one does not ship.
Your company runs alone
Each company gets its own cluster: its own database, encryption keys, sign-in and AI connections. We operate it for you, or it runs in your own cloud account.
No public address
Clusters accept no connections from the internet. They reach our router through a private tunnel, and every request is signed and verified.
An index, not a copy
Drive files stay in Drive and mail stays in Gmail. Varro keeps the searchable text, its index and a link back. Uploaded files are kept, because Varro is their only home.
Personal email stays out
Email is classified before it is stored. Only a short, redacted excerpt is checked, through a provider with zero data retention, and personal mail is never stored.
AI assistants never set their own access
An AI assistant acts as its person, with that person's permissions, checked from a signed token on every call. Nothing an AI assistant says about itself changes that.
A tripwire for prompt injection
Content guards look for instructions aimed at AI in every email, file and note. Your company chooses to block, flag or allow each kind. Permissions never depend on them.
Everything is recorded
Sign-ins, approvals, decisions and setting changes go into an audit trail, and documents keep their version history.
Built on
Proven infrastructure, strict boundaries.
A small, well-understood stack. AI assistants connect through an open standard, so you are not tied to one AI vendor.
GoPostgreSQLpgvectorKubernetesCloudflareModel Context ProtocolOAuth 2.1 + PKCERow-level security
Diligence
Security reviews, welcome.
We answer security questionnaires, architecture reviews and data-residency questions formally, under NDA. Tell us what your review needs and we will walk through it with your team.
You choose where it runs
A dedicated cluster in the region your policies require, or inside your own cloud account.
Offboarding is immediate
Remove someone and their sign-in, their AI connections and their access end on the next request.
Never used for training
Your content trains no models. Email checks run with zero data retention and no training, enforced on every request.
A record for your auditors
Sign-ins, approvals, releases and setting changes are recorded with who did them and when.
Join the waitlist
Give your AI the company it works for.
We are onboarding a small group of companies ahead of general availability. Join the waitlist and a person will write back within one working day.