Security & data
What happens to your price books and quotes.
ReadyVariant is in customer preview. This page describes exactly how it works today, including what it does not do yet.
Where your data lives
Each workspace has its own database file and its own storage folder on a single server that ReadyVariant operates. Uploaded price books, schedules, catalogs, customers and quotes are only reachable through a signed-in session for that workspace. The website runs on Cloudflare, which forwards requests to the server over HTTPS with a private secret.
Accounts and sessions
Passwords are stored as salted scrypt hashes, never in plain text. Sign-in cookies are HttpOnly, Secure and SameSite=Strict, and expire after 12 hours. Email verification is required, and password resets revoke existing sessions. Each workspace currently has a single owner; team roles and SSO are not available yet.
Backups
Every night the databases are copied with SQLite’s online backup API and integrity-checked, then the copy and the uploaded files are encrypted and stored off-site in Cloudflare R2. Daily copies are kept for 14 days and weekly copies for 8 weeks. A restore drill runs every month: the latest backup is restored to a scratch copy, verified, and started.
How AI is used
AI runs only when you start it. It receives sheet headers, a few sample rows, notes and cell references, never whole workbooks, and requests are sent with storage disabled at the provider. Its suggestions are proposals: nothing is applied or published until you confirm it, and prices are always calculated by ReadyVariant’s own engine, never by the AI.
Calculations and files
Prices come from the price books and rules you confirmed. Excel formulas, macros and external links are never executed; saved values are read instead. Shared website configurator links show only what you chose to share, never your source sheets or price sources.
ReadyVariant sends email only for account verification, password resets and the owner notifications you turn on. Quotes are not emailed to your customers by ReadyVariant.
Export and deletion
Ask for an export or deletion of your workspace and it is handled within 30 days, sent to or confirmed with the verified owner email. Deletion removes the workspace, its files and its account records; encrypted backup copies expire as retention rolls them out, within 8 weeks. Self-service export is not available yet.
What is not in place yet
There is no SOC 2 report, SSO, audit export or data-residency choice in the customer preview. If any of those are requirements, raise them before a pilot so we can say plainly what is and is not possible.
See it with your own data.
Start with one spreadsheet and a result you already know.