Trust & Security · how we treat your systems and your data

A security tool should survive its own due diligence.

This page is written the way we’d want a supplier to write it for us: specific commitments, and how each one is actually enforced — in the system, not the marketing.

The crib sheet
for your due-diligence form · always true
On record
Where does data live?London · eu-west-2
What gets scanned?verified domains only
Can evidence be altered?no — signed manifest
Can history be edited?no — append-only audit
Does AI invent findings?never
every answer below names how it’s enforced — in the system, not the marketing
Scanning conduct

How we behave on your infrastructure.

1.1

We only scan what you've proven you own.

Domain ownership is verified by DNS TXT record before any scan can be created — and re-verified at the start of every job, not just at setup. If verification lapses, scheduled scans refuse to fire.

enforced in code · worker re-checks at job start
1.2

Safe-by-default, rate-limited, polite.

Checks run read-only or safe-mode by default; active rules only on scopes you explicitly approve. Politeness rate limits and host exclusions are configurable per project and enforced server-side with hard ceilings.

enforced in code · server-side rps/timeout ceilings
1.3

Scanners run in locked-down isolation.

Each scan job runs in a short-lived container with a read-only filesystem, all capabilities dropped, and no access to other tenants' jobs or data. Scan execution is fully separated from the control plane.

enforced in infrastructure · cap-drop ALL, no shared state
From the worker log — a lapsed verification, refused
job 8841 · acme-software.co.uk · pre-flight ownership re-check → TXT record missing · scan REFUSED · audit entry written · owner notified
Not a policy promise — the worker’s actual behaviour when a verification lapses.
Your data

Where it lives, and who controls it.

2.1

UK data residency, full stop.

Tenant data — findings, evidence, audit history — is stored in AWS eu-west-2 (London). It doesn't leave the region for processing.

enforced in infrastructure · single-region deployment
2.2

Export everything. Or delete everything.

Owners can export a complete bundle of everything the tenant owns — projects, assets, scans, findings, packs, audit log — as structured JSON. Project deletion is immediate, cancels schedules, and blocks queued scans before they spawn.

enforced in code · owner-only export, audited deletion
2.3

Strict tenant isolation in a shared service.

Every record carries a tenant identifier and every query is tenant-scoped at the repository layer. Cross-tenant access is treated as a highest-severity defect class, tested for continuously.

enforced in code · tenant scope on every query
Evidence integrity

Why your reviewer can trust the pack.

3.1

Packs are tamper-evident.

Every evidence pack carries an HMAC-SHA256-signed manifest covering its contents. Verification works offline, with no Origin account — your reviewer doesn't have to trust us, or you.

enforced in code · signed manifest per pack
3.2

The audit log only ever grows.

Every state change — scans, suppressions, role changes, exports — writes an append-only audit entry with actor and timestamp. Append-only is enforced at the database layer; there is no edit path, including for us.

enforced in database · no UPDATE/DELETE grants
3.3

AI explains; it never testifies.

Findings come from deterministic scanners. AI rewrites them for different readers and drafts summaries — always displayed beside the verbatim evidence, with schema-bound output. Anything unverifiable is dropped before storage.

enforced in code · schema-bound outputs, evidence linkage
From the audit log — one finding’s full story
9 Jun 14:02finding #142 created · scan #17 · nuclei
9 Jun 14:31assigned to sam@acme · by maya@acme
11 Jun 09:15resolved · confirmed by re-scan #18
11 Jun 09:16included in evidence pack Q2-2026 · signed
This is the line your reviewer wants to see — and nobody, including us, can edit it.
The stack, named

Built on engines you can look up.

We orchestrate respected open-source scanners rather than inventing a proprietary black box. You can read their documentation, their templates, and their CVE coverage yourself.

OWASP ZAP
API scanning from your imported OpenAPI definitions — the most widely used open web application scanner in the world.
Nuclei
Templated vulnerability and misconfiguration checks, community-reviewed and updated daily.
httpx
Fast HTTP probing and surface fingerprinting that keeps your asset inventory honest.
AWS eu-west-2
Control plane, workers and storage in the London region. Secrets in AWS Secrets Manager; artefacts in S3.
An honest tool

What we won’t claim.

This is not a penetration test.

Automated external checks are affordable, repeatable and useful — and they are not a substitute for skilled manual testing. We'll never pretend otherwise, and your evidence packs say exactly what was checked.

AI never invents findings.

Deterministic scanners find; AI explains. Every AI-written sentence sits next to the raw evidence it came from, and anything that can’t be traced to evidence is dropped, not shown.

We don't scan what isn't yours.

Ownership is verified before any scan, and re-verified every time one starts. Safe-by-default rate limits mean we never hammer your production systems — or anyone else’s.

Questions your security reviewer will ask? Send them here.

Or start the trial and inspect the audit log yourself.