Enterprise
Team access and audit trails, without becoming another vendor to review.
Every outbound call a scan makes is enumerated in the subprocessor register, findings are exportable and deletable on demand, and the audit log is tamper-evident — the answers a security review asks for, published before it asks.
Governance and access control
Access is something the platform can prove, not something it promises: the audit chain, the role model, and the key lifecycle below are all inspectable from inside the product.
Tamper-evident audit log
Every security-relevant action — logins, scans, settings changes, verification attempts — records actor, action, target, and IP into a hash chain. Each entry hashes the previous one, so altering history breaks the chain, and an owner can verify it on demand.
Role-based access and data isolation
Two roles, owner and user. A user sees only the assets they created and the scans they personally triggered; another account's scan returns 404 rather than 403, so its existence is never confirmed to someone without access.
Organizations
A shared scanning scope for a team, layered alongside personal scans rather than replacing them. Run a scan as an organization and every member can open it. Members join through single-use, expiring, hash-stored invite links.
API keys and CI/CD gating
Keys inherit the role of the account that created them, are shown once, stored only as a SHA-256 hash, and can be revoked instantly. The bundled CLI fails a pipeline below a score threshold you choose.
Deployment and operations
One deployment, no hidden backend
Scan results, findings, and audit history live in the deployment's own database and nowhere else. Every external service a scan contacts is enumerated in the subprocessor register, and export and account deletion are self-service.
Two-factor authentication
Optional TOTP enrollment per account (RFC 6238, any standard authenticator app) with one-time backup codes. Disabling it requires re-entering the account password.
Rate limiting on every account surface
Failed logins, signups, MFA attempts, and scan submissions are all bounded. Note that limits are in-memory and per-process, so a multi-instance deployment needs a shared limiter.
Alerting into tools you already run
Monitoring alerts deliver as generic JSON, or pre-formatted for Slack, PagerDuty, Datadog, or Splunk HEC. Destination URLs are SSRF-guarded when saved and again before each delivery.
What this is not, stated up front.
A security vendor that only lists strengths is asking you to do the discovery yourself. These are the gaps that matter most to an enterprise evaluation, and they are the same ones listed in the Security Policy.
Read the full limitations- No SSO or SCIM — accounts are local to the deployment.
- No encryption at rest for the database file, including MFA secrets.
- No self-service password reset — account recovery goes through the operator.
- Organizations are deliberately minimal: no nested teams, org-level keys, or org-level billing.
- No SOC 2, ISO 27001, or third-party penetration test. The compliance mappings are situational context, not audit evidence.
Keep reading
Where most people go next
Evaluate it against a real target
Nothing to request, no sales call — sign up and scan something you own.