Security First
We take the security of our platform and your data seriously.
Encryption in transit and at rest
TLS 1.3 with perfect forward secrecy on every connection. Secrets and stored credentials are encrypted with AES-256-GCM, under a key held separately from the token-signing key.
Isolated execution
Scans run server-side in a dedicated scan container, one process per job. The command is tokenised before any of your values are substituted, so no shell is involved, and every query is scoped to your organization.
SOC 2-aligned controls
Infrastructure designed against the SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, Privacy). The Type II audit has not been completed — the framework table below says exactly where each one stands.
Append-only audit logging
Privileged actions are written to an append-only audit log, scoped to your organization and queryable from the dashboard. Logs are retained for a year.
MFA, SSO and roles
Multi-factor authentication over TOTP with single-use backup codes. SAML 2.0, OIDC and LDAP / Active Directory single sign-on on Enterprise. Role-based access control is enforced on the server, not in the UI.
Maintained toolchain
Scanner images and their vulnerability templates are rebuilt and redeployed by us. You never update a scanner, and you never patch a Kali box.