Frequently asked questions
Short answers on what Perimetry Cloud does, what it never does, ownership proof, the score, plans, data and support.
About the service
What does Perimetry Cloud do?
It audits what anyone on the internet can see about your domains, on a schedule: e-mail authentication (SPF, DKIM, DMARC), DNS, certificates, subdomains, mail servers, websites, exposed services and look-alike domains. Each audit gives a score, findings with their fix, and what changed since the previous one, and alerts you when something changes. Between audits, it also watches certificate logs and whether your site answers.
Does it attack or scan my servers aggressively?
No. Every check is passive: it reads public DNS, certificate logs, public databases and the ordinary answers of your servers, as any visitor would. It never tries to sign in, never exploits anything, and the optional probe for sensitive files only asks for a few well-known paths, without keeping their contents.
Is it the same as the open-source Perimetry scanner?
The audits run the same open-source scanner, Perimetry. Perimetry Cloud adds what a one-off scan cannot: ownership proof, scheduled audits, history, alerts, certificate and uptime watch, DMARC reports, reports for clients and the rest of the app.
Domains and ownership
Why do I have to prove that the domain is mine?
The full audit shows details that could help an attacker (a subdomain that can be taken over, an exposed service). Those are for the owner only. Publishing a TXT record is quick and is the usual way to prove it. See Prove that a domain is yours.
Can I check a domain that is not mine?
Yes, with the public checks only: the free check, a supplier on the Suppliers page, or a pre-audit of a prospect on the Agency plans. Findings whose details could help an attacker are then named by family only.
Should I enter www.example.com or example.com?
The registrable domain: example.com. Its subdomains, www included, are found automatically.
Can I remove the TXT record once the domain is verified?
No: it is checked every day. After three days in a row without it, the domain is marked as lost and its audits stop until it is back.
Score and findings
How is the score computed?
It starts at 100 and loses 30, 12, 5 or 1 point for each critical, high, medium or low finding; the same kind of finding repeated on several hosts counts a quarter for each repeat. A is 90 and above, B 75, C 60, D 40, F below. See How the score is computed.
A finding is wrong, or we accept the risk. What can I do?
Accept it with a justification: it leaves the score and goes to the risk register, with a review date. See Accept a finding as a risk.
I fixed something. Do I have to wait for the next audit?
No. Check if it is fixed re-runs that one check in seconds. The score follows at the next audit, which you can start with Audit now.
Plans and account
Is the Free plan really free?
Yes: one domain, a full audit every month, no card. Paid plans add domains, more frequent audits and more features. See Plans, payment and invoices.
Can I work with my team or my clients?
On the Agency plans: team members with roles, clients with their own alerts and monthly PDF reports, and tickets. The API and the MCP server come from the Solo plan. See Team members and roles and Clients and their monthly reports.
Is the app available in French or German?
Yes, the whole app, the findings, the reports, the alerts and the e-mails, in English, French and German. Choose in Settings › Language.
Where is my data, and can I delete it?
The service is hosted in the European Union. You can export a workspace as JSON or delete it from Settings. See Your data.
How do I contact you?
Write to hello@perimetry.cloud. To report a vulnerability in Perimetry Cloud itself, see the security page.