You authorize our scanner.
Here is how we earn that.
Our customers trust us to scan their own domains, and security teams notice when a vendor cuts corners — so do we. This page documents how we run the service, how our scanner behaves, our disclosure policy, and our compliance roadmap.
Encryption everywhere
TLS 1.2+ for every connection in and out. Data at rest is encrypted with AES-256 on the database tier and object storage.
Strong authentication
Passwords are bcrypt-hashed (rounds=12) with a 12-character minimum, and sign-in is rate-limited with account lockout after repeated failures. Google sign-in is available where it is enabled for your deployment. If your organisation needs SAML, talk to us — it is not part of a published plan today.
Least-privilege access
Database credentials live only in our hosting platform's encrypted environment configuration and never in source control, connections are TLS-only, and every query that reads findings is scoped to the account's work-email domain plus the domains it has proven it controls (DNS TXT record, HTTPS file or administrative-mailbox confirmation). Admin access is limited to named accounts.
Backups & recovery
The production database is backed up by our managed database provider under the schedule and retention of our plan with them; we'll tell you what that is in writing — email legal@vulnverify.com. We don't hold an independent backup copy and we don't run scheduled restore drills yet. Both are on the roadmap, and this card changes when they exist.
Vetted infrastructure
The application and database run on SOC 2-certified providers (Vercel, Supabase); the scan runner runs on a server hosted by Contabo GmbH in Germany (EU). Every sub-processor is listed in our DPA. Cross-border data transfers are covered by the EU Standard Contractual Clauses.
Secure development
Every change is lint- and typecheck-gated and must pass an automated test suite before it ships — that gate runs in CI on every push and pull request. Dependency updates and upstream advisories are handled as part of our release process; we don't run an automated CVE scanner today.
Responsible disclosure
If you find a security issue in VulnVerify itself, please report it to security@vulnverify.com. You can request our public PGP key from the same address.
We commit to: acknowledging your report within 24 hours, providing a triage update within 5 business days, and publicly crediting valid reporters (with permission) once the issue is resolved.
We ask that you: give us reasonable time to address the issue before public disclosure, don't access data beyond what's necessary to prove the issue, and don't disrupt the service for other users.
A public bug-bounty program with paid rewards is on our roadmap. To be notified when it opens, email security@vulnverify.com.
Our scanner
VulnVerify scans a domain only after its owner has proved control of it and recorded an authorization. What the scanner runs, its rate limits, its scope filter, the addresses its traffic comes from and how to stop it are published in our scanning policy.
Seeing scanner traffic you did not expect? Email security@vulnverify.com with the time, the source address and the host that received it.
Compliance roadmap
| Framework | Status | Notes |
|---|---|---|
| GDPR | Compliant | DPA available on request; cross-border data transfers are covered by the EU Standard Contractual Clauses. |
| SOC 2 Type II | In progress | Actively working toward SOC 2 Type II, with a target report in Q4 2026. Our current security controls and documentation are available on request to security@vulnverify.com. |
| ISO 27001 | On the roadmap | Planned alongside SOC 2 once we hit team-of-10 size. |
| DPA (EU/UK) | Available | Request via legal@vulnverify.com. |
Data handling overview
We store the minimum data needed to operate the service: account email, hashed password, organization, subscription tier, your saved searches, watchlists, and alert configurations.
For each domain you add, we also keep its verification record (how and when you proved control of it), its scan authorization (the name and job title of the person who gave it, when, and the version of the text they accepted), the results of every scan we run of it (each finding's host, path, check, severity and CVE or CWE, with a short evidence excerpt our scanner redacts before it leaves the scanner), and the SHA-256 fingerprint of every report we issue. Scan results are your data: see section 6 of our Privacy Policy for what we store and who can see it, and section 8 for what removing a domain deletes and the two records that outlive it.
We never sell your data. We never train third-party AI models on your queries, and we never use your scan results to train any AI model. We don't share search history, watchlists or scan results with anyone outside our team. Unless you share a report yourself, the only thing anyone else can see about a scan is what our report verification page shows to whoever holds one of your reports' fingerprints: the domain, the issue date, the kind of scan and its finding counts, never a finding.
For details on retention, third-party sub-processors, and your rights as a data subject, see our Privacy Policy.