Encryption at rest
Confidential assets are encrypted with AES-256-GCM before storage, with authenticated encryption so tampering is detectable.
Trust and security
Evidence, identity and governance
The platform holds your vulnerability data
Confidential evidence encrypted before storage and scanned for malware; access governed by MFA, fine-grained roles, audit trails and administrative IP allowlisting.
These controls describe the platform’s own assurance. They are separate from — and do not by themselves determine — the security outcome of your program.
Platform viewLive
- Evidence filesencrypted
- Malware scanclean
- Accessleast privilege
- Audit trailrecorded
Controls
How evidence and access are protected
Controls that matter because reports contain production details, credentials used during testing, and sometimes customer data.
Multi-engine scanning
ClamAV and VirusTotal scanning, file-type validation and automatic quarantine when a file is flagged.
Access-controlled operations
Every file read, write and delete is authorised against identity and permission — an object identifier alone is not enough.
Credential locker
Testing credentials distributed under control and scoped to the engagement instead of shared over email.
MFA and session control
TOTP MFA for all account types, with sessions that can be listed and revoked.
Fine-grained RBAC
Distinct permission sets for owners, administrators, program managers, researchers, experts and platform administrators.
Audit trail
Administrative actions recorded: who did what, to which record, and when.
Governance workflows
Approval queues for program and participant onboarding, and step-up verification on sensitive financial operations.
Administrative hardening
IP allowlisting for administrative surfaces and rate limiting on authentication and high-risk operations.
Evidence handling in practice
Small habits that make a large difference to how well evidence is protected.
- Ask for the smallest artefact that proves the issue — usually a request/response pair.
- Ask researchers not to paste real customer data; request redacted copies where data is unavoidable.
- Prefer test accounts to production credentials, and use the credential locker when real access is needed.
- Treat a quarantined attachment from a new account as a signal worth a second look.
- Keep evidence attached to the finding so closures stay verifiable later.
- Review roles periodically: access granted for one project tends to stay granted.
Assurance summary
What the platform controls, and what remains your organisation’s responsibility.
- Storage
- Encrypted at rest for confidential assets; access-controlled and authenticated per operation.
- Scanning
- Multiple engines with automatic quarantine and file-type validation before storage.
- Authentication
- Standards-based tokens with asymmetric signing, OAuth sign-in, TOTP MFA, session revocation.
- Authorisation
- Role-based, least-privilege by default, with entitlement-aware feature gating.
- Expert access
- Gated on role, organisation entitlement and an accepted invitation — all three required.
- Governance
- Audit trail, approval queues, step-up verification and administrative IP allowlisting.
- Your side
- Retention and privacy obligations, legal review of policy, and the security outcome of your own program.
Documentation
Trust and security in full
Evidence and file security
Upload modes, encryption, scanning, quarantine and retention.
Read the docIdentity and access
Authentication, the expert access gates, RBAC and the audit trail.
Read the docDisclosure and safe harbor
Policy templates and disclosure coordination.
Read the docCommon questions
Security questions we hear most
Where does evidence actually live?
In an encrypted store. Confidential files are encrypted with AES-256-GCM before storage, scanned by multiple malware engines, and retrievable only through authenticated, permission-checked operations.
How is expert access controlled?
An expert must hold the expert role, be covered by the organisation’s entitlement, and have accepted a valid invitation to that engagement. The checks are enforced at access-decision time, not only in the interface.
Who can see our findings?
Access is role-scoped: a researcher sees their own submissions, a program owner sees their program, and unrelated participants see neither. Administrative actions are recorded in the audit trail.
Do these controls mean we are secure?
They describe the platform’s own assurance — encryption, MFA, RBAC, audit trails and scanning. The security outcome of your program also depends on your scope, your remediation and your own controls.
Review the controls that matter to your reviewers.
We will walk your security team through evidence handling, the access model and the audit trail — including what stays on the platform and what moves into your tooling.