This page is written the way we’d want a supplier to write it for us: specific commitments, and how each one is actually enforced — in the system, not the marketing.
Domain ownership is verified by DNS TXT record before any scan can be created — and re-verified at the start of every job, not just at setup. If verification lapses, scheduled scans refuse to fire.
Checks run read-only or safe-mode by default; active rules only on scopes you explicitly approve. Politeness rate limits and host exclusions are configurable per project and enforced server-side with hard ceilings.
Each scan job runs in a short-lived container with a read-only filesystem, all capabilities dropped, and no access to other tenants' jobs or data. Scan execution is fully separated from the control plane.
Tenant data — findings, evidence, audit history — is stored in AWS eu-west-2 (London). It doesn't leave the region for processing.
Owners can export a complete bundle of everything the tenant owns — projects, assets, scans, findings, packs, audit log — as structured JSON. Project deletion is immediate, cancels schedules, and blocks queued scans before they spawn.
Every record carries a tenant identifier and every query is tenant-scoped at the repository layer. Cross-tenant access is treated as a highest-severity defect class, tested for continuously.
Every evidence pack carries an HMAC-SHA256-signed manifest covering its contents. Verification works offline, with no Origin account — your reviewer doesn't have to trust us, or you.
Every state change — scans, suppressions, role changes, exports — writes an append-only audit entry with actor and timestamp. Append-only is enforced at the database layer; there is no edit path, including for us.
Findings come from deterministic scanners. AI rewrites them for different readers and drafts summaries — always displayed beside the verbatim evidence, with schema-bound output. Anything unverifiable is dropped before storage.
We orchestrate respected open-source scanners rather than inventing a proprietary black box. You can read their documentation, their templates, and their CVE coverage yourself.
Automated external checks are affordable, repeatable and useful — and they are not a substitute for skilled manual testing. We'll never pretend otherwise, and your evidence packs say exactly what was checked.
Deterministic scanners find; AI explains. Every AI-written sentence sits next to the raw evidence it came from, and anything that can’t be traced to evidence is dropped, not shown.
Ownership is verified before any scan, and re-verified every time one starts. Safe-by-default rate limits mean we never hammer your production systems — or anyone else’s.
Or start the trial and inspect the audit log yourself.