Varonis privacy & data

Customer metadata refers to information that describes or contextualizes that content (such as user identities, file/folder/path names, email addresses/subjects/senders/recipients, domains, and IP addresses, timestamps, or communication attributes).

Customer data refers to the actual content stored within files or communications (such as document text or email bodies)

Varonis technology crawls data sources for the purpose of threat detection and response, data security, compliance and remediation.

Varonis Email Interceptor monitors email communications of organizational employees and detects spam emails and malicious patterns

Our default retention policy for the Subscriber Data on the Varonis SaaS platforms, is a sliding window of 180 days during the subscription term

Varonis does not retain the content of the emails, unless it is detected to be a malicious email.

Email samples submitted as part of false positive/false negative investigations of Varonis Interceptor are deleted 30 days after case is closed.

Upon the end/termination of the subscription term, Subscriber Data which is held by Varonis at such time shall be deleted within up to 30 days after termination of the subscription.

Upon onboarding, Varonis' Data Security Platform can be set to operate from the geography of the customer’s choice.

When required by law, Varonis also incorporates the GDPR's Standard Contractual Clauses (SCCs), or their UK and Swiss counterpart, or the EU-US Data Privacy Framework (DPF)

or the EU-US Data Privacy Framework (DPF), including the UK and Swiss extensions

The full list of Varonis sub-processors and their locations of processing can be found in our Sub-Processors list .

Any transfer of personal information will be subject to a data processing agreement (DPA)

Request to cease processing or delete PII: dl-privacy-requests@varonis.com

We have implemented the necessary mechanisms to enable users to exercise such rights.