Our security
How we handle access to your infrastructure and your data, including the parts that are not finished yet.
Our access principles
Nothing is connected today
Vynna is pre-launch. We have no connection to any customer's clusters, hold no credentials and do not currently process customer infrastructure data. Any examples on the site are fictional.
Read-only is a commitment, not an impossibility
The assessment will run on read-only access that you grant us. We never ask for write permissions. This page used to say the product could not change anything because no connection existed. With connected analysis it is a commitment from us instead, and we would rather you heard that difference from us than found it yourself.
You decide the scope
Which clusters are included, what access we get and how long it lasts are agreed in writing before anything is connected.
Metadata, minimised
The analysis works on configuration, capacity and cost lines, never on the contents of databases, storage or queues. Workload specifications and metadata can still contain sensitive details, so the export is minimised and redacted, and you review it before it leaves your environment.
We never change production
The analysis reads. We propose actions in a report, and you are the one who carries them out.
You decide on changes
Every recommendation is a proposal your team can accept, adjust or reject. Nothing is automated and nothing is carried out for you.
Access is revoked when the engagement ends
We ask you to switch the credential off once the assessment is delivered, and confirm in writing when we no longer have access. Because it lives in your environment, you never need our permission to withdraw it.
What we never do
- We never change anything in your production environment.
- We don't read Secret objects, logs or the contents of your databases.
- We never ask for write access, and we require no agents in your production workloads.
- We do not resell cloud capacity and we take no vendor commission.
- We do not replace your hosting provider. We review the platform, we do not run it.
- We do not certify that you meet NIS2 or GDPR. We show selected technical observations relevant to NIS2 and GDPR control areas; we do not assess full compliance.
How the assessment is meant to work
This is the whole chain. None of this is in operation yet.
- 01
We agree the scope
Which clusters are included, what read-only access is needed and how long it should last, in writing and before anything is connected.
- 02
You grant read-only access
You create the credential in your own environment and can revoke it whenever you like. We never ask for write permissions.
- 03
We read configuration and cost lines
The analysis collects sizing, capacity, usage and cost. It never reads the contents of your databases, storage or queues.
- 04
We produce the report
Findings become a prioritized list with an evidence source, a level of confidence, a level of risk and a concrete action.
- 05
You receive the report
What we retain of the underlying material, and for how long, will be written here before the first connection is made.
How infrastructure credentials are handled
Connected analysis means we will hold read-only credentials to your clusters. That is a question of trust, so here is exactly what we do and what we do not.
- Today we hold no credentials to any customer's infrastructure, because no connection exists.
- We never request write access, meaning no role that can change, scale, delete or deploy.
- The credential is kept in a password manager secured with two-factor authentication. It never sits in email, in chat, or as a loose file on a laptop.
- It is scoped to the clusters we have agreed, and time-limited where your platform supports it. If it needs renewing you issue a new one; we do not rotate it on your behalf.
- When the engagement ends we ask you to revoke it, we delete our copy, and we confirm in writing on what date that happened.
- Reads are made under a service account carrying our name. If API audit logging is enabled in your cluster with a policy that records them, you can review exactly what we did without relying on a log we keep ourselves.
- If anyone requests infrastructure credentials in Vynna's name without a written agreement with us covering the scope, refuse and tell us.
Who else processes data
Vynna processes contact details and the information you submit through our contact and interest forms. Form submissions are delivered via Resend. Cloudflare delivers the website and processes ordinary technical request data, such as IP address, time and requested page. These services are not used for customers' Kubernetes or infrastructure data.
Cloudflare
Hosting and edge network. Serves the site and processes ordinary request metadata.
Resend
Delivers contact and pilot form submissions to our inbox. Resend is a US company.
Google Fonts
Serves the site's typefaces. The service receives request metadata such as your IP address, but never any infrastructure data.
Infrastructure data
The website does not receive Kubernetes configuration, kubeconfig files, scanner results or other infrastructure data. Such material is processed only within a separate review engagement with a written agreement, an agreed scope, a retention period and a deletion process.
Swedish-owned, under EU jurisdiction
Vynna is owned and run from Sweden, with no US parent company. Where your data is actually processed is a separate question, and it is answered in the sovereignty section below, not here.
Data flows and jurisdiction, precisely
Sovereignty is used loosely by a lot of vendors. Here is exactly where we stand, so you can judge it against your own requirement rather than a marketing word.
The website processes no infrastructure data
There is no upload and no analysis on the site. The only thing it receives is what you type into a form.
Analysis environment and AI
Customer material is never sent to external cloud-based AI services. The analysis is carried out with open audit tools and human verification in a controlled analysis environment. A local language model may only be used offline after separate written customer approval. The model has no network access and is never an evidence source or final decision-maker.
Separate risk dimensions
EU location, the provider's ownership and applicable jurisdiction are separate risk dimensions. Vynna documents the actual data flows and contractual terms so that you can assess them against your own requirements.
Where we actually stand on compliance
Vynna is early. What follows is the honest status rather than the reassuring version, because a security page that overstates is worse than no security page at all.
True today
- There is no connection to any customer's infrastructure, and no credentials are held.
- Vynna does not currently process customer infrastructure data. Any examples on the site are fictional.
- The website never receives infrastructure data. There is no upload and no analysis on the site.
- We never request write access, and we never carry out changes for you.
Not in place yet
- No SOC 2, ISO 27001 or equivalent certification. We have none, and will not imply otherwise.
- A data processing agreement is entered into before any processing where the parties' roles and the planned processing require it.
- No automated rotation and no audit dashboard of our own. Rotation happens by you issuing a new credential, and the audit trail is your own log rather than a tool on our side.
- The exact retention terms for material from an engagement will be written here before any customer infrastructure data is processed.
If any of this changes, this page changes with it and the review date moves. If something here is wrong or out of date, tell us and we will correct it.
Last reviewed: 9 Oct 2026