Security tooling for the person who owns it among other things
Most companies don’t lose to a sophisticated attack. They lose to the host nobody wrote down. So we made the unglamorous part the product: the inventory, the schedule, the order of work, the evidence.
1
person can reach production, and every action is logged
0
third parties get your data, including AI services
180
days to permanent deletion after you leave
SOC 2
audit under way, our processes tracked in Drata
Four positions, each with a consequence
The engine is not the product
Scanning engines are the commodity part. Our own effort goes into everything around them.
Report less, be checkable
Every finding ships with its evidence: host, status code, banner, certificate date, line of code.
Shallow every day beats deep once a year
A pentest says how far someone could get. A schedule says what changed since Friday.
Nothing between you and the product
Price on the page, product clickable before signup, no call required to find out whether it fits.
What we built, in five steps
- Step 1
Discover
Public certificate logs, DNS and one ordinary request per host
- Step 2
Confirm
A review queue: nothing is scanned until you say it’s yours
- Step 3
Scan
Perimeter, running applications and the code behind them
- Step 4
One list
Severity, SLA timers, snooze, false positives, dated history
- Step 5
Report
One score and the record an audit conversation needs
External checks run on proven, industry-standard engines, and the engines are replaceable. The inventory, the ordering and the record are not, and that is where our work goes.
Four things we deliberately don’t do
Touching anything before you confirm it’s yoursExploiting what we findUnreleased features in the present tensePromising you compliance
Ports and active templates only on targets you confirmed — in some jurisdictions an unauthorised port scan is a criminal matter.
Rate-limited, nothing destructive sent, no data modified. Rather point it at staging than guess.
Auto-fix and PR review say coming soon. Certificates mean expiry dates. Cloud means EC2 and Route 53.
We produce the evidence auditors ask for. Whether it satisfies your scope is your auditor’s call, not ours.
Code, applications and the perimeter in one subscription — run by one person who has other work
That constraint decides every trade-off we make.
Who this is for — and who it isn’t
The second column costs us sales and saves you a month.
A good fit
A CTO, Head of DevOps or lead developer who owns security among other things
10 to 200 people, with a perimeter and repositories to match
Infrastructure that changes weekly, and news of it arriving late
Preparing for SOC 2, ISO 27001 or a customer’s security review
Anyone who wants to try the thing before talking to a person
Not a good fit
A dedicated security team with a SIEM — we’d be a subset of what you run
A signed penetration test this quarter — different service, and a good one
Internal or air-gapped environments — nothing for us to see from outside
One number for the board and nothing else — the score is here, the work is the point
An agent on every server — we deliberately don’t have one
Where your data lives, in six lines
Location
Hetzner cloud, Ashburn, Virginia, US
Production access
Head of DevOps only, every action logged
Third parties
None, including third-party AI services
Your source code
Clone deleted after the scan; only affected lines kept
Audit
SOC 2 in progress, processes tracked in Drata
Leaving
Everything removed within 180 days of deletion
The same answers appear in our FAQ. If your security review needs them in a questionnaire, ask — we would rather answer once, properly.
The fastest way to judge us is one domain
Add it, see what answers, and decide in five minutes whether any of the above is true.
Full functionality · no credit card · you choose which hosts get scanned