Your data. Your control. Enterprise-grade security.
Varda Forms is designed with security at its core. As a self-hosted solution, your data never leaves your infrastructure — giving you complete control over your most sensitive information.
Self-Hosted Architecture
Your data stays on servers you own and control. We never have access to your operational data, form submissions, or user information.
Data Sovereignty
Keep your data in your jurisdiction. Meet Canadian PIPEDA, provincial privacy laws, and US state requirements by controlling where your data resides.
Complete Audit Trail
Every action is logged with timestamps and user attribution. Demonstrate compliance with immutable records that can't be altered.
Built-in protection at every layer
Authentication & Access Control
- Secure password hashing — bcrypt with industry-standard salt rounds
- Role-based access control — granular permissions so users only access what they need
- Session management — secure tokens with configurable expiry and automatic logout
- SSO integration — connect your existing identity provider
- Two-factor authentication (TOTP) — authenticator-app codes with single-use backup codes and lockout; leave it optional or enforce it for admins or everyone
Data Protection
- Encryption in transit — all data transmitted over TLS 1.2+
- Encryption at rest — whole-database encryption (SQLCipher), or targeted field-level AES-256-GCM, with key rotation
- Secure file storage — uploads stored with access controls and optional encryption
- Data isolation — complete separation between departments and user groups
- Backup & recovery — built-in tools with point-in-time recovery
Audit & Compliance
- Complete audit logging — every submission, approval, edit, and user action
- Tamper-proof records — immutable audit trails with cryptographic verification
- Chain of custody — full history of who accessed, modified, or approved each record
- Regulatory exports — audit-ready packages in one click
- Retention controls — configure record retention to match your policy
Encryption, 2FA & a self-hosted supply chain
Encryption & Two-Factor Authentication
- Whole-database encryption at rest with SQLCipher, or targeted field-level AES-256-GCM — your choice
- Encryption keys are kept separate from the application secret and can be rotated
- Authenticator-app 2FA (TOTP) with single-use backup codes and automatic lockout after repeated failures
- Organization-wide 2FA policy — optional, required for administrators, or required for everyone
Self-Hosted Deployment & Signed Updates
- One-command install, with Docker, cloud-init and Terraform starters
- Automatic HTTPS — reach it by your own domain, a private outbound tunnel, or LAN only
- Updates are signature-verified and applied only when an administrator approves them
- Only the update component can touch the container runtime — the application never does
- Built-in backup & restore for the database and keys
The safest place for your data is your own server
Cloud platforms make headlines when they get breached — and their customers' data goes with them. With Varda Forms, there is no shared multi-tenant database to breach. Your installation is yours alone, behind your firewall, under your policies.
- No third-party access to your operational records
- You control backups, retention, and residency
- Works inside air-gapped or restricted networks
- Vendor changes can never strand your data
Questions about security or hosting?
Bring your IT team to the demo — we'll walk through architecture, requirements, and deployment options together.