Help centre
How to use Perimetry Cloud: adding and proving domains, reading reports and the score, fixing findings, alerts, DMARC, monitoring, compliance, agencies, account and billing.
New here? Start with Getting started with Perimetry Cloud.
No article matches. Try another word, or write to us at hello@perimetry.cloud.
Browse by topic
Getting started
Getting started with Perimetry Cloud
From a new account to your first full audit: create the account, add a domain, run the quick check, publish the TXT record and read the report.
Add a domain and run the quick check
Which name to enter, what the quick check before the ownership proof shows and hides, and the limits on adding domains.
Prove that a domain is yours with a TXT record
Publish the _perimetry TXT record, check it, fix the common mistakes, and know what happens if the record disappears.
Reports and score
Read a report
What each part of a report means: severities, findings with their fix and evidence, what was observed, the history, the PDF and accepted findings.
How the score and the grade are computed
The score starts at 100 and loses 30, 12, 5 or 1 point per critical, high, medium or low finding, repeats counting a quarter. Grades A to F.
Show your score with a public page and a badge
Turn on a public score page for a proved domain, put the badge on your site, and know what visitors can and cannot see.
Compare a domain with its peers
Set a domain against the French communes of the same size measured by Perimetry Research, check by check, with the source and the edition.
Dashboard and domains
The dashboard: posture, actions and what is coming due
The average score of your proved domains, the actions ranked by the points they bring back, the open findings, this week’s changes and deadlines.
Your list of domains and their settings
Search, filter and sort the domain list, understand each status, and change a domain’s audit frequency, options, client, pause or removal.
Import a list of domains
Add up to 500 domains at once from a pasted list or a CSV file, file them under clients, and download every TXT record to publish.
Fixing findings
Fix a finding and check that it is fixed
Use the fix, the evidence and the DNS records ready to copy, then “Check if it is fixed” to re-run that one check in seconds.
Findings explained by AI
Ask for an explanation of a finding and the steps to fix it on your platform: what is sent, your monthly allowance, and why to check each step.
DNS fixes in one click with Cloudflare, OVHcloud or Gandi
Connect the provider that holds your zone, preview a fix before and after, apply it, and undo any change from the domain page.
Open tickets in GitHub, Jira or Linear
Connect a tracker, choose which new findings become tickets, open one by hand from a report, and see tickets updated when the audit finds the fix.
Accept a finding as a risk
When a finding is a false positive or a known trade-off: accept it with a justification, a scope, a review date and an optional expiry.
Taking down a look-alike domain
A takedown case for a look-alike: evidence collected passively, abuse letters to the registrar and the host, reporting services, checks until it is gone.
The remediation plan
Assign findings to members with a due date and a status, comment on each one, filter “Mine”, get reminders, and export the plan as CSV or PDF.
Monitoring
The timeline of changes
Every change seen on your proved domains, dated: subdomains, ports, DNS, mail, certificates, look-alikes. Filter it, export it, know which ones alert.
The inventory of your assets and its map
Hosts, IP addresses and open ports, certificates and technologies seen by the latest audits, with filters, CSV exports and a map of who hosts what.
Certificate Transparency watch
How the certificates issued for your domains are read between audits, what makes one unusual, and what to do when you get an alert.
Uptime monitoring
How often your site is checked, what counts as down, the Availability card, the address to watch, and downtime alerts.
Public status pages
Publish a status page from the uptime checks: components, 90 days of availability, incidents and maintenance, e-mail subscriptions and feeds.
The WordPress plugin
The score in the WordPress dashboard: free check, connection on any plan, ownership proved by the site, and what WordPress itself shows, with your consent.
Verified active scan (coming soon)
Sign an authorization for a proven domain, start an active scan with Nuclei and ZAP, signed in if you wish, and read which suspicions of the audit are confirmed.
E-mail and DMARC
Receive and read DMARC reports
Turn on DMARC reports, publish the record with our address, see who sends mail in your name and which senders fail, and read TLS reports.
DMARC step by step to p=reject
Move from p=none to quarantine, then reject, when the reports show it is safe: the rules, the “Not mine” button and the alert.
Alerts and integrations
Slack, Microsoft Teams and PagerDuty
Send the alerts to Slack and Teams as rich messages, and critical findings and outages to PagerDuty, resolved by themselves once fixed.
The weekly summary by e-mail
What the weekly e-mail says for each workspace, how to choose its day and hour, send one now, or stop it in one click.
Alerts by e-mail and webhook
Add e-mail addresses and webhooks (Slack, Discord, ntfy or JSON), choose the rule (changes, issues, always), route by client and test a channel.
Your deadlines in your calendar (iCal)
Subscribe to certificate and domain expiries, DMARC steps and risk reviews in Google Calendar, Outlook or Apple Calendar.
The API and API keys
Create a read-only or audit key, then read domains, findings and comparisons, start audits and follow them: the API reference, with curl examples.
Perimetry Cloud in your CI (GitHub Action)
Run an audit after each deployment and fail the job when the score drops or a critical finding appears: GitHub Action, GitLab CI and any other CI.
The MCP server for Claude and other assistants
Let Claude Code or another MCP client read your scores, findings and fixes through the remote MCP endpoint, with a read-only key if you wish.
Breached addresses with your Have I Been Pwned key
Paste your own Have I Been Pwned key to count, at each audit, the addresses of your domains found in known data breaches.
Threat intelligence: leak sites and password stealers
What the daily checks of ransomware leak sites, password-stealing malware and abuse.ch mean for your domains and suppliers, and what to do.
Compliance, risks and suppliers
The risk register
Every accepted finding with its justification, owner, review date and history: statuses, reminders, renewal, closing and exports for an assessor.
Reporting an incident under NIS2
The 24-hour, 72-hour and one-month deadlines counted for you, drafts in the authority’s language prepared with what we saw, and a log of what was sent.
Answering a security questionnaire you received
Paste the questions, get answers proposed from your library and from what we prove on your domains, correct them, keep them, and copy them back.
The monthly page for management and its approval
A plain-words page each month for the people who run the company, approved once the month is over, frozen and sealed with a fingerprint.
The compliance view: NIS2, ISO 27001, Cyber Essentials
How each finding relates to NIS2 Article 21(2), ISO/IEC 27001:2022 Annex A and Cyber Essentials, and what an outside view can and cannot tell.
Attestations for an insurer or an assessor
Issue a dated PDF of what the monitoring saw over a period, let anyone check it with its QR code, and revoke it if needed.
Watch your suppliers
Follow your suppliers’ domains: weekly public checks, alerts when a score drops, and a security questionnaire pre-filled with what we see.
For agencies
Clients and their monthly reports
Group domains by client, route their alerts, and send each client a monthly PDF report with your logo, in English, French or German.
Pre-audits of prospects
Run the public checks on a company you want to work with, send a PDF or a link in your name, see when it is opened and turn a win into a client.
Portfolio audit of your clients’ sites
Ask for access, paste up to 30 client domains and see them ranked by exposure, with each one’s score and worst problems.
Partner program: agencies, hosts and registrars
Apply as an agency, share your referral link and earn 20% for 12 months; as a host or registrar, show your customers’ score in your panel.
Pre-launch check of a client site
Prove the host of a site you are about to launch, run the website checks on it, and get a launch checklist with the fixes to make first.
Account, team and billing
Team members and roles
Invite colleagues as admin, member or viewer, what each role can do, and how members are removed.
Secure your account: second factor, passkeys, Google
Turn on the second factor, sign in with a passkey or with Google, change your password or your e-mail address, and recover a forgotten password.
Language, theme and quick search
Choose English, French or German for you and for the workspace’s alerts and reports, pick a light or dark theme, and jump anywhere with ⌘K.
One-off report without a subscription
On the Free plan: the full audit, the PDF report and attestations for one domain for 30 days, €49 once, taken off your invoices if you subscribe.
Plans, payment and invoices
What each plan includes, how to subscribe, change or end a plan, replace the card, add a VAT number and download invoices.
Your data: export, deletion and privacy
Export a workspace as JSON, delete it, know how long data is kept and what we never collect.
Free tools and questions
The free check and the free tools
Check any domain without an account, compare it with similar public bodies, and use the thirteen free tools for e-mail, DNS, certificates, NIS2 and more.
Frequently asked questions
Short answers on what Perimetry Cloud does, what it never does, ownership proof, the score, plans, data and support.
Did not find your answer? Write to us at hello@perimetry.cloud.