Protect the evidence without hiding the boundaries.
Purposeful collection, protected credentials, workspace separation, secure transport, and documented incident response.
Controls
Security at a glance
visitor v_7c1e…a90
email never sent
Collect what you enable
Each product collects only what it needs; secrets and sensitive personal information should never be sent.
Roles and separate workspaces
Role-based access and separate customer workspaces. You assign roles and remove access that is no longer needed.
Browser keys and server secrets
Publishable keys for the browser; server ingest secrets stay in protected server, edge or backend environments.
Scoped GitHub publishing
Short-lived tokens for one repository, approval checked again before writing, and never a force push.
HTTP/2 200
strict-transport-security
x-content-type-options: nosniff
permissions-policy: camera=()
Hardened responses
Response headers such as HTTP Strict Transport Security and nosniff are one layer of defense.
Logged and monitored
Logging, monitoring and a documented incident response, with a path to report a security issue.
Data minimization
Instrumentation is progressive, so you enable only what you need:
Collection choices and lawful notices remain a shared responsibility between Virent and the customer.
- 01URL-only visibility monitoring needs no browser or server telemetry
- 02Human Analytics collects the events you enable for your measurement plan
- 03AI Crawler Analytics captures the request metadata used for classification and coverage
- 04Secrets and sensitive personal information should never be sent
Access and workspace controls
Virent uses role-based access, authentication protections, protected production credentials, and separation of customer workspaces. You are responsible for:
- 01Protecting account credentials
- 02Assigning appropriate workspace roles
- 03Removing access that is no longer required
- 04Securing their own systems and integrations
- 05Notifying Virent of suspected unauthorized access
Encryption and secrets
Data in transit uses current industry-standard transport protocols, with encryption at rest where the storage layer supports it. Publishable browser keys and server secrets serve different purposes:
- 01Publishable keys may be used by the approved browser integration
- 02Server ingest secrets belong only in protected server, edge, proxy, or backend environments
- 03No secret should be committed to source, bundled into the browser, or emailed to support
Content Agent and GitHub publishing
Content Agent publishes only revisions a person has approved, and only to GitHub repositories you connect through the Virent GitHub App.
- 01You choose which repositories the app can access, and can revoke that access in GitHub at any time
- 02Each publishing step uses a short-lived GitHub token limited to one repository and the permissions that step needs
- 03Virent checks the approval, your current permissions, and the destination again immediately before writing
- 04Publishing never force-pushes, and Virent never reverses a remote publication automatically
- 05Fetched web pages and repository text are treated as evidence, never as instructions to the agent
Application and platform protections
Application controls include response headers such as:
Headers are one layer of defense, not a complete security program, and their details evolve with the architecture.
- 01HTTP Strict Transport Security
- 02X-Content-Type-Options: nosniff
- 03Frame restrictions
- 04Strict referrer policy
- 05Permissions restrictions for camera, geolocation, and microphone
Logging, monitoring, and response
Virent maintains logging, monitoring, dependency management, backup and recovery, and documented incident response proportionate to the service and its risk. If Virent becomes aware of a Security Incident affecting Customer Personal Data, it notifies the customer without undue delay, as described in the Data Processing Addendum.
Vendors and subprocessors
Vendors and subprocessors that provide infrastructure and product capabilities are subject to review and contractual data-protection obligations. The Data Processing Addendum lists the current subprocessors, including the web research, search data, storage, model, and GitHub providers Content Agent uses, and the data each receives.
Secure implementation guidance
visitor v_7c1e…a90
email never sent
Human Analytics
- Use the publishable write key in browser code.
- Limit collection to the measurement plan.
- Review consent and notice requirements.
- Configure Content Security Policy deliberately.
AI Crawler Analytics
- Store the full ingest secret in a protected environment variable.
- Capture only intended routes.
- Exclude APIs, static assets, robots files, and sensitive paths.
- Treat robots directives as guidance, not access control.
API and integrations
- Use documented interfaces.
- Scope and rotate keys.
- Do not build against internal application endpoints.
- Sanitize logs and support artifacts.
Reporting a security issue
Report suspected security issues privately to virent.app@gmail.com with the subject "Private security report". There is no public bug-bounty or safe-harbor program.
Include
- the affected surface;
- a concise description;
- safe reproduction steps;
- observed and potential impact;
- a contact method for follow-up.
Do not
- access data that is not yours;
- disrupt or degrade the service;
- use social engineering;
- send live credentials or unnecessary personal information;
- disclose publicly before Virent can investigate.
Questions
Frequently asked questions
Is Virent certified under a specific security framework?
No certification is claimed on this page. Contact Virent for the security information currently available.
Does Virent use customer data to train general-purpose AI models?
Virent's current Privacy Policy states that it does not use Customer Data to train general-purpose AI models unless the customer expressly agrees.
Is robots.txt enough to protect private content?
No. Private content requires authentication and server-side authorization.
How long does Virent keep data?
Default periods are 395 days for human analytics events, 90 days for crawler analytics events, 730 days for usage records, 90 days for raw web pages fetched for content research, and 30 days for operational logs. Approved article revisions stay with the article until it is deleted. The Privacy Policy describes these defaults and the limits of deletion from backups and remote destinations.
Where are privacy roles and international-transfer terms described?
Review the Privacy Policy and Data Processing Addendum.
Need security or procurement information?
Contact Virent with the product surface, review context, and information your team needs. Do not send credentials or sensitive customer data.