Security and data handling
What the product does to keep an organisation’s data separate and safe, stated plainly.
In short
- Each organisation’s data is kept apart by row-level security in the database.
- Access is by invitation, with a one-time email link and optional two-factor that an organisation can require.
- Data is held in a managed Postgres database in the UK (London), encrypted at rest and in transit.
- No agent is installed on your devices, and the pages load no third-party scripts or tracking cookies.
- Outside systems reach it only through a read-only API and a TAXII feed, using tokens an admin creates and can revoke.
People and access
- Access
- By invitation only. People sign in with a one-time link sent to their email address. An owner can also create a password account for a person or a test account; sign-in attempts are rate limited and logged, and organisations can require two-factor.
- Two-factor
- Members can add an authenticator app. An organisation can require it, and a session without it is sent to set it up before it sees anything else. An owner can waive it for a named non-admin account for a stated reason and a limited time; each waiver is recorded in the audit log.
- Roles
- Owner, admin, analyst and viewer. Changing settings, members and integrations needs admin; viewers cannot change anything.
Your data
- Separation
- Every organisation’s data is held under row-level security in the database, so one organisation cannot read another’s, whatever the page asks for.
- Where data lives
- A managed Postgres database in the UK (London). The provider encrypts data at rest and in transit.
- What is collected
- What you add (domains, suppliers, software, device lists), public threat sources, and public records about your own domains (certificate logs, Shodan InternetDB). If you connect Microsoft Defender, its software and vulnerability list; and only if an admin switches the hunt on, which known-bad indicators your devices contacted, with up to five device names each. No agent is installed on your devices.
The platform
- In the browser
- A strict content security policy with per-request script nonces, no third-party scripts and no advertising or tracking cookies.
- Connections
- Outbound to public threat sources and the integrations you switch on. Inbound only through the read-only JSON API and TAXII feed, with API tokens an admin creates, can scope and revoke. New lookalike domains are checked automatically with urlscan.io, your reputation sources and the domain registry (WHOIS). Keys you enter are stored server-side and never shown again.
Reporting a problem
Found something? Tell us through the security contact file or the request form on the front page. Please do not test against other organisations’ data.
See the sample company or request access.
This page describes the product as built. It is not a certification or a substitute for a supplier assessment; ask for the detail you need.