Variable is committed to maintaining the security, confidentiality, and integrity of our customer’s data. We have implemented a comprehensive security program that includes administrative, technical, and physical safeguards to protect the data that we process. You can see more details in our Trust Center.Documentation Index
Fetch the complete documentation index at: https://docs.variable.global/llms.txt
Use this file to discover all available pages before exploring further.
How your data is protected
Variable’s security program covers the people, processes, and infrastructure handling your data:- Encryption - data is encrypted in transit (TLS) and at rest
- SOC 2 Type II - independently audited controls covering security, availability, and confidentiality
- Regular testing - third-party penetration tests and continuous internal security reviews
- Role-based access - owners, admins, contributors, and viewers, with per-organization scoping
- SSO - single sign-on available for enterprise plans
Reporting a vulnerability
If you believe you’ve found a security vulnerability in Variable, please report it to us privately at security@variable.co. Please do not file a public issue. Please include:- A description of the issue and its potential impact
- Steps to reproduce, or a proof-of-concept
- The affected component, endpoint, or version (if known)
- Any relevant logs, screenshots, or sample payloads
/.well-known/security.txt per RFC 9116.
What to expect from us
When you report a vulnerability in good faith, we will:- Acknowledge receipt within 3 business days
- Make best efforts to keep you updated and promptly complete our investigation and, if applicable, confirm our remediation strategy within an established timeline
- Credit you in the release notes once a fix is shipped, if you’d like
Scope
In scope:- The Variable web application (app.variable.global)
- The Variable public API
- The Variable MCP endpoint
- Official Variable client libraries and integrations
- Findings from automated scanners without a demonstrated impact
- Denial-of-service attacks, volumetric attacks, or rate-limit testing
- Social engineering of Variable employees, customers, or partners
- Physical attacks against Variable offices or infrastructure
- Issues in third-party services we depend on (please report those directly to the upstream vendor)
- Vulnerabilities requiring physical access to a user’s device or a fully compromised account
Safe harbor
We will not pursue legal action against researchers who:- Make a good-faith effort to comply with this policy
- Avoid privacy violations, data destruction, and service disruption
- Give us reasonable time to remediate before any public disclosure
- Only interact with accounts they own or have explicit permission to test