Varnish Software

What Is Varnish Software?

The story starts in 2005, when a system administrator at the Norwegian newspaper VG Multimedia sketched out a faster way to serve web pages. Anders Berg's specification became Varnish Cache, an open-source HTTP accelerator led by developer Poul-Henning Kamp and released in September 2006. Facebook and WikiLeaks were both running on it by 2010, the same year Varnish Software AB was founded in Stockholm to commercialise the project.

Sweden's Neqst took a majority stake in 2013, alongside Swedish investor SwediaCapital — both domestic, so the company remains an independently run Swedish business rather than a foreign-owned subsidiary. Today Varnish Software still co-maintains the free, BSD-licensed Varnish Cache while selling Varnish Enterprise, a commercial platform that layers a Web Application Firewall, edge compute, and multi-terabyte video caching on top. In April 2025 it launched Ora Streaming, a private CDN-as-a-service built with Intel and wholly owned by Varnish Software.

For European buyers, the pitch is straightforward: a sovereign, self-hosted alternative to Cloudflare or Fastly, backed by a company with fifteen years of open-source credibility and ISO 27001-certified Nordic offices.

Key Features

Programmable Caching with VCL

Varnish's defining feature is VCL — Varnish Configuration Language — which compiles down to C rather than being interpreted at runtime. It gives engineers granular control over request routing, cache invalidation, header manipulation, and load balancing across static or dynamic backends. This is a real strength for teams that need custom logic, but it is not a drag-and-drop interface; expect a learning curve if your team lacks caching or infrastructure experience.

Varnish Enterprise's Edge and Security Layer

Beyond the open-source core, Varnish Enterprise adds an in-process Web Application Firewall (vmod-waf), TLS/mTLS termination, JWT verification, and rate limiting — all executed at the node level rather than routed through a third party. Edge compute capabilities include key-value storage and SQLite integration, letting teams build latency-sensitive logic directly at the edge. Native AWS S3 and Akamai integration modules make it plausible to run Varnish alongside, or instead of, hyperscaler CDN services.

Video and API Delivery at Scale

The Massive Storage Engine (MSE) is built for multi-terabyte datasets, supporting VOD and HLS/DASH byte-range caching for streaming platforms. Varnish also markets itself for REST and GraphQL API acceleration, absorbing traffic spikes and offloading authentication checks from origin servers. The company claims throughput of up to 1.5 Tbps per server, a figure aimed squarely at broadcasters and high-traffic SaaS platforms rather than small websites.

Sovereign CDN Positioning

Varnish's most distinctive pitch is architectural, not just technical: run a private CDN on Kubernetes, on-premise hardware, or any cloud, without recurring per-gigabyte egress charges from a hyperscaler. Ora Streaming extends this into a fully managed private CDN specifically for video, launched with Intel and now live in EMEA and Asia-Pacific. For regulated industries wary of routing traffic through US-owned infrastructure, this self-hosted model is arguably Varnish's clearest differentiator.

Pricing

Varnish Software does not publish list prices, and every serious deployment runs through a sales conversation. Third-party software marketplaces list Varnish Enterprise Standard starting near $15,000 per year for small and medium businesses, though Varnish itself has not confirmed that figure. Premium tiers add a dedicated Slack channel with Varnish engineers, managed services through Varnish Assist+, and custom SLAs for mission-critical workloads.

A 30-day free trial ships with full Enterprise features enabled, which is generous compared to the shorter evaluation windows some CDN competitors offer. If budget certainty matters more than architectural control, usage-based CDNs like Bunny.net will be easier to forecast. Teams that need deep customisation, and are prepared to negotiate, should treat the trial as the real starting point for pricing discussions rather than the marketing site.

EU Compliance & Privacy

Varnish Software's compliance story rests on its Nordic footprint rather than a single blanket certificate. The company holds ISO 27001 certification for its Oslo, Karlstad, and Stockholm offices, effective since April 2023, alongside an established Information Security Management System. Because Varnish Enterprise typically runs on the customer's own infrastructure — cloud, on-premise, or hybrid — data residency is largely determined by where the customer chooses to deploy it, not by Varnish's own data centres.

That self-hosted model is itself a compliance advantage for organisations that need to keep traffic entirely within EU borders. Sub-processors are reviewed for GDPR alignment, and the platform supports TLS/mTLS termination and cache encryption for data in transit and at rest. Buyers in finance, media, or the public sector should still confirm exact deployment topology during the sales process. Self-hosting only guarantees EU residency if the underlying servers are actually located in the EU.

Who It's Best For

Streaming and broadcast platforms handling multi-terabyte video libraries will get the most from the Massive Storage Engine and Ora Streaming's managed private CDN. Platform engineering teams who already run Kubernetes or manage their own infrastructure can exploit VCL's flexibility without needing to hire outside consultants. Organisations with strict data sovereignty requirements — banks, public bodies, telcos — benefit from a self-hosted CDN layer that avoids routing traffic through US hyperscalers.

If your team wants a CDN that works out of the box with minimal configuration, Bunny.net or Cloudflare will be a faster path to production. Varnish instead rewards teams willing to invest in infrastructure expertise with a level of control that fully managed CDNs simply do not offer.

The Verdict

Few CDN vendors occupy a position like this: a genuinely open-source pioneer that has spent fifteen years building a credible commercial layer on top of its own free software. The result is Varnish Enterprise, a deeply capable, self-hosted CDN and edge platform that suits organisations with real infrastructure teams and genuine data sovereignty requirements. It is not the easiest CDN to adopt, and undisclosed enterprise pricing will frustrate buyers who want a self-serve quote.

For teams that can absorb the VCL learning curve, though, Varnish offers a rare combination. It brings open-source transparency, Nordic-grade compliance, and enough raw throughput to run video platforms and high-traffic APIs without leasing capacity from a US cloud giant.

Frequently Asked Questions

Is Varnish Software GDPR compliant?

Yes. Varnish Software is headquartered in Stockholm, Sweden, and holds ISO 27001 certification for its Oslo, Karlstad, and Stockholm offices. The company reviews its sub-processors for GDPR compliance and applies privacy-by-design principles across its platform.

What is the difference between Varnish Cache and Varnish Enterprise?

Varnish Cache is the free, open-source HTTP accelerator that Varnish Software co-maintains under a BSD licence. Enterprise is the commercial platform built on top of it, adding a Web Application Firewall, edge compute, the Massive Storage Engine for video, and 24/7 professional support.

How much does Varnish Enterprise cost?

Pricing itself is not published; all Enterprise licensing is quote-based. Third-party marketplaces list Varnish Enterprise Standard starting near $15,000 per year for small and medium businesses, with Premium tiers priced individually. A 30-day free trial with full Enterprise features is available before committing.

Is Varnish a CDN or caching software?

Both. At its core, Varnish is an HTTP caching engine deployed in front of your own servers. Enterprise extends that into a full sovereign CDN — including edge compute, WAF, and video delivery — running on your own infrastructure or in the cloud instead of a third-party network.

What is Ora Streaming and how does it relate to Varnish Software?

Ora Streaming Inc. is a wholly owned subsidiary of Varnish Software AB, launched in April 2025 in strategic alliance with Intel. It offers a fully managed private CDN built specifically for live and on-demand video streaming, separate from the self-managed Varnish Enterprise product.