Security and data
A security service has to hold itself to the standard it measures. This page says what we do with your data and how we protect our own service, in plain terms.
What an audit does to your systems
Nothing you would notice. Each check reads public DNS records, public certificate logs, public data sets (Shodan's InternetDB, CISA's exploited-vulnerabilities list, EPSS, Spamhaus), or the response your web and mail servers already give to any visitor: one HTTPS request to the home page and a handful of well-known files, one TLS handshake, one SMTP greeting to each mail server. We follow the robots.txt conventions where they apply, identify ourselves in the User-Agent header, and never send more than a few requests per host per audit.
We do not scan ports, exploit vulnerabilities, guess credentials, submit forms or crawl your site. Probing for sensitive files (backups, configuration files, exposed repositories) exists as an option, off by default, available only on domains with proven ownership, and it never stores the contents of what it finds, only the fact that the file is reachable.
Ownership proof
You can preview a report for any domain, because everything in it is public. But alerts, history, scheduling and look-alike monitoring are only enabled after you add a TXT record we give you to the domain's DNS zone. We check it before every audit. If it disappears, audits stop and we tell you. This keeps Perimetry Cloud from being used to watch domains that are not yours.
What we store
- Your account: e-mail address, password hash (Argon2id), second-factor secret if enabled, billing country and VAT number for invoicing.
- Your domains and their ownership status.
- Audit results: findings, scores and the snapshot used to compute changes (host names, DNS records, certificate fingerprints, open ports, look-alike list). We keep no copy of your pages; the web checks keep only the headers and a few extracted facts such as the names of detected libraries.
- Alert settings: e-mail addresses and webhook URLs, which are encrypted at rest.
History is kept for the period of your plan (12 or 24 months) and for 90 days after cancellation, then deleted. You can export everything as JSON at any time and delete your account yourself.
Where it lives
On servers in the Netherlands, in the European Union, with encrypted volumes and encrypted daily backups kept in the EU. Cloudflare sits in front of the service; the origin accepts no direct traffic. Payment details never reach our servers: the payment provider handles the card and sends us a token.
How the service protects itself
- Passwords hashed with Argon2id; optional time-based one-time codes as a second factor; passkeys (WebAuthn, with the device’s own lock always required); sign-in with Google, which only ever opens an account its owner linked to that Google account, never one that merely shares its address; sign-in rate limited and locked after repeated failures; adding or removing a way to sign in asks you to confirm it is you, and the last one cannot be removed; sessions bound to the browser and expired after inactivity.
- All traffic over HTTPS with HSTS preloaded; strict Content-Security-Policy; the same security headers we grade you on.
- The audit worker runs in isolated containers with no access to the database other than through a queue; it cannot be reached from the internet.
- Outbound connections from the worker refuse private, loopback and link-local addresses at connection time, so a domain record cannot be used to make us probe our own network.
- Dependencies updated automatically and scanned on every build; the open-source scanner runs the same checks against itself.
Penetration testing
Every six months, Perimetry Cloud undergoes a penetration test covering the website, the application, its API and the infrastructure behind them. Unlike our own audits, which stay passive, these tests actively try to break in, as an attacker would. The problems they find are fixed in order of severity. They come on top of the continuous measures above and of the reports we receive from security researchers.
Reporting a vulnerability
If you find a security problem in Perimetry Cloud or in the open-source scanner, write to security@perimetry.cloud. We answer within two business days, keep you informed, and credit you if you wish. Please do not test against other customers' domains or accounts; a free account and your own domain are enough to reproduce most issues. Our security.txt carries the same information.
Sub-processors
Hosting in the Netherlands; Cloudflare for DNS, TLS termination, e-mail sending and the web application firewall; a payment provider for card processing. The list is kept current on this page.