# Protect the evidence without hiding the boundaries.

> Review Virent's data minimization, access control, encryption, secret handling, logging and security-reporting practices.

Canonical: https://virent.app/security
Last updated: 2026-07-29

Purposeful collection, protected credentials, workspace separation, secure transport, and documented incident response.

## Security at a glance

### Collect what you enable

Each product collects only what it needs; secrets and sensitive personal information should never be sent.

### Roles and separate workspaces

Role-based access and separate customer workspaces. You assign roles and remove access that is no longer needed.

### Browser keys and server secrets

Publishable keys for the browser; server ingest secrets stay in protected server, edge or backend environments.

### Scoped GitHub publishing

Short-lived tokens for one repository, approval checked again before writing, and never a force push.

### Hardened responses

Response headers such as HTTP Strict Transport Security and nosniff are one layer of defense.

### Logged and monitored

Logging, monitoring and a documented incident response, with a path to report a security issue.

## Data minimization

Instrumentation is progressive, so you enable only what you need:

> Collection choices and lawful notices remain a shared responsibility between Virent and the customer.

- URL-only visibility monitoring needs no browser or server telemetry;
- Human Analytics collects the events you enable for your measurement plan;
- AI Crawler Analytics captures the request metadata used for classification and coverage;
- secrets and sensitive personal information should never be sent.

## Access and workspace controls

Virent uses role-based access, authentication protections, protected production credentials, and separation of customer workspaces. You are responsible for:

- protecting account credentials;
- assigning appropriate workspace roles;
- removing access that is no longer required;
- securing their own systems and integrations;
- notifying Virent of suspected unauthorized access.

## Encryption and secrets

Data in transit uses current industry-standard transport protocols, with encryption at rest where the storage layer supports it. Publishable browser keys and server secrets serve different purposes:

- publishable keys may be used by the approved browser integration;
- server ingest secrets belong only in protected server, edge, proxy, or backend environments;
- no secret should be committed to source, bundled into the browser, or emailed to support.

## Content Agent and GitHub publishing

Content Agent publishes only revisions a person has approved, and only to GitHub repositories you connect through the Virent GitHub App.

- you choose which repositories the app can access, and can revoke that access in GitHub at any time;
- each publishing step uses a short-lived GitHub token limited to one repository and the permissions that step needs;
- Virent checks the approval, your current permissions, and the destination again immediately before writing;
- publishing never force-pushes, and Virent never reverses a remote publication automatically;
- fetched web pages and repository text are treated as evidence, never as instructions to the agent.

## Application and platform protections

Application controls include response headers such as:

> Headers are one layer of defense, not a complete security program, and their details evolve with the architecture.

- HTTP Strict Transport Security;
- X-Content-Type-Options: nosniff;
- frame restrictions;
- strict referrer policy;
- permissions restrictions for camera, geolocation, and microphone.

## Logging, monitoring, and response

Virent maintains logging, monitoring, dependency management, backup and recovery, and documented incident response proportionate to the service and its risk. If Virent becomes aware of a Security Incident affecting Customer Personal Data, it notifies the customer without undue delay, as described in the Data Processing Addendum.

## Vendors and subprocessors

Vendors and subprocessors that provide infrastructure and product capabilities are subject to review and contractual data-protection obligations. The Data Processing Addendum lists the current subprocessors, including the web research, search data, storage, model, and GitHub providers Content Agent uses, and the data each receives.

- [Read the Data Processing Addendum](https://virent.app/dpa)

## Secure implementation guidance

### Human Analytics

- Use the publishable write key in browser code.
- Limit collection to the measurement plan.
- Review consent and notice requirements.
- Configure Content Security Policy deliberately.

### AI Crawler Analytics

- Store the full ingest secret in a protected environment variable.
- Capture only intended routes.
- Exclude APIs, static assets, robots files, and sensitive paths.
- Treat robots directives as guidance, not access control.

### API and integrations

- Use documented interfaces.
- Scope and rotate keys.
- Do not build against internal application endpoints.
- Sanitize logs and support artifacts.

- [Read the documentation](https://virent.app/docs)

## Reporting a security issue

Report suspected security issues privately to virent.app@gmail.com with the subject "Private security report". There is no public bug-bounty or safe-harbor program.

### Include

- the affected surface;
- a concise description;
- safe reproduction steps;
- observed and potential impact;
- a contact method for follow-up.

### Do not

- access data that is not yours;
- disrupt or degrade the service;
- use social engineering;
- send live credentials or unnecessary personal information;
- disclose publicly before Virent can investigate.

## Frequently asked questions

### Is Virent certified under a specific security framework?

No certification is claimed on this page. Contact Virent for the security information currently available.

### Does Virent use customer data to train general-purpose AI models?

Virent's current Privacy Policy states that it does not use Customer Data to train general-purpose AI models unless the customer expressly agrees.

### Is robots.txt enough to protect private content?

No. Private content requires authentication and server-side authorization.

### How long does Virent keep data?

Default periods are 395 days for human analytics events, 90 days for crawler analytics events, 730 days for usage records, 90 days for raw web pages fetched for content research, and 30 days for operational logs. Approved article revisions stay with the article until it is deleted. The Privacy Policy describes these defaults and the limits of deletion from backups and remote destinations.

### Where are privacy roles and international-transfer terms described?

Review the Privacy Policy and Data Processing Addendum.