Security
Built for teams that look at the details.
You are trusting us with the map of your network. Here is how the platform protects it. We do not hold compliance certifications yet; ask us anything below.
Tenant isolation
- Every customer table is protected by PostgreSQL row-level security keyed on your organization; user-facing queries run under a role that cannot read other organizations' rows.
- Time-series tables that cannot use row-level security are always filtered by organization explicitly, and covered by tests.
- Every page, action and API route checks the signed-in user's organization and role before touching data.
Accounts and access
- Passwords are hashed; sign-in with Google is available.
- Two-factor sign-in (authenticator apps, with backup codes), session list and remote sign-out.
- Roles: owner, admin, member and read-only viewer.
- An append-only audit log of sign-ins, member, key, integration and sharing events, visible to admins.
Secrets
- API keys and agent keys are stored only as hashes; the plaintext is shown once.
- Test secrets (passwords, keys, secret variables) are write-only in the dashboard and API, sent only to the agents that run the test, and masked in results.
- Cloud credentials are an IAM role with an external ID, or an access key encrypted with AES-256-GCM.
- Webhook and channel URLs are never sent to the browser, and outbound webhooks cannot reach private addresses.
Agents
- Agents only connect out, over HTTPS, with a per-agent key; enrollment tokens can be set to expire and revoked.
- Agent-to-agent traffic is authenticated with per-test keys.
- Self-updates are checked against published SHA-256 checksums before they are installed.
- Agents run tests you define and nothing else: there is no remote shell.
Hosting and data
- Hosted in an EU data centre (France), served over HTTPS only.
- Raw results are kept 30 days and 1-minute rollups 90 days, then deleted automatically.
- Nightly database backups, kept for 14 days.
- Public share links are unguessable, read-only snapshots that expire.
Found a vulnerability?
Please tell us privately through the contact form and give us a chance to fix it before you disclose it. We reply quickly and credit researchers who want it.
See whose network it is, on your own traffic
Free during the beta. Install an agent in one command and your first test is live in minutes.