Sign inSee what's exposedTrust
What we do, and what we will never do
How our checks work, where your data lives, who can see it, and how long we keep it.
We never log in on Free or Standard
On these plans every check runs from outside, with no credentials, and nothing signs in to your systems.
When a check tests an issue, it stops at proof
Some checks confirm an issue by testing it, and each one is deliberately harmless. For a remote code execution flaw, that means running a command such as whoami or reading a standard system file: enough to show the issue is real, and nothing further.
Every finding carries its evidence
Each finding records the exact request we sent and the response we received, so your team can reproduce it. The same evidence goes out in the SIEM export.
A person confirms every finding before you see it
Nothing reaches your account until an analyst has confirmed it.
Scanning on behalf of a client
An MSP adding client domains agrees in writing that they are authorised to scan them, and an analyst confirms the account. That happens once.
Your data
Where it lives, who can see it, how long we keep it
The Data Processing Agreement and Privacy Policy are the binding versions of everything in this section.
Where it lives
Dedicated servers in the European Economic Area, in Germany and Finland. There is no US region, and the region is not chosen at sign-up. Our hosting provider is named in the DPA by category; its identity is available on request.
How it is protected
AES-256 encryption at rest and TLS 1.3 in transit. Each customer’s data is kept apart by row-level isolation in the database. Backups are encrypted, taken daily and kept for 30 days.
Who can see it
Access is role-based and limited to what each role needs, with multi-factor authentication for admin access. Staff are background-checked, sign NDAs and take data protection training every year. Every access to data is logged.
If something goes wrong
We notify customers of a personal data breach within 48 hours, as set out in the DPA.
- Account information
- For the life of the account, plus 30 days after deletion
- Billing records
- 7 years
- Threat intelligence data
- Your plan’s retention period, from 7 days to unlimited
- Search query logs
- 90 days
- Legal acceptance records
- For the life of the account, plus 7 years
- Support communications
- 3 years after resolution
- Server access logs
- 90 days
After these periods, data is securely deleted or anonymised. If you leave, your data is returned to you as JSON or deleted within 30 days, and we certify the deletion on request.