Security
How we protect your data and maintain the highest security standards.
Encryption
All data is encrypted in transit using TLS 1.3 and at rest using AES-256. Scanning credentials are stored using industry-standard key management.
Infrastructure Security
Our infrastructure runs on SOC 2 Type II certified cloud providers with network segmentation, intrusion detection, and 24/7 monitoring.
Access Controls
Role-based access control (RBAC) limits data access. Multi-factor authentication is required for all employee access to production systems.
Monitoring & Logging
Comprehensive audit logging of all access and changes. Security events are monitored in real-time with automated alerting.
Vulnerability Management
We practice what we preach. Our own infrastructure undergoes continuous vulnerability scanning and regular penetration testing.
Compliance
Our security program is designed to meet SOC 2 Type II requirements. We undergo regular third-party security assessments.
Our Commitment to Security
As a security company, we hold ourselves to the highest standards. We understand that you're trusting us with sensitive information about your infrastructure, and we take that responsibility seriously.
Data Protection
Encryption
- In Transit: All communications use TLS 1.3 with strong cipher suites
- At Rest: AES-256 encryption for all stored data
- Credentials: Scanning credentials are encrypted using a dedicated key management system and are never logged or exposed
Data Isolation
Customer data is logically isolated at the application layer. Each customer's scan results, configurations, and credentials are segregated and access-controlled.
Data Retention
Scan results are retained for the duration of your subscription plus 90 days. You can request immediate deletion of your data at any time. We do not retain customer data for longer than necessary.
Infrastructure Security
Cloud Security
Our infrastructure is hosted on enterprise-grade cloud providers that maintain SOC 2 Type II, ISO 27001, and other certifications. We leverage:
- Virtual private clouds with strict network segmentation
- Web application firewalls (WAF)
- DDoS protection
- Automated security patching
Monitoring
Our security operations include:
- 24/7 infrastructure monitoring
- Real-time security event alerting
- Comprehensive audit logging
- Regular log review and analysis
Organizational Security
Personnel
- Background checks for all employees with access to customer data
- Security awareness training upon hire and annually
- Principle of least privilege for all access
- Immediate access revocation upon termination
Development Practices
- Secure development lifecycle (SDLC)
- Code review requirements for all changes
- Automated security testing in CI/CD pipeline
- Regular third-party penetration testing
Incident Response
We maintain a documented incident response plan that includes:
- Detection and analysis procedures
- Containment and eradication steps
- Customer notification within 72 hours of confirmed breach
- Post-incident review and improvement
Compliance
Our security program is designed to meet or exceed the requirements of:
- SOC 2 Type II
- GDPR (for EU customers)
- CCPA (for California residents)
Security Contact
To report a security vulnerability or concern:
Email: security@vulnerabilityscan.com
We appreciate responsible disclosure and will acknowledge receipt within 24 hours.
Ready to secure your infrastructure?
Get started with managed vulnerability scanning today.
Sign Up Now