Security Policy

ThreatSense is a passive public-website and domain checker. Security is built into every layer of the product: we never authenticate to your systems, we never run intrusive scans, and we only read what the public can already see. We apply least-privilege access and defence-in-depth throughout.

All account data is encrypted in transit using TLS 1.2+ and at rest using AES-256. Each customer’s data is logically isolated and never crosses tenant boundaries. Scan results belong to you and are retained only as needed to provide the service.

Access to production systems is restricted to authorised personnel. We enforce least-privilege, role-based access (owner, admin, member) and audit logging of administrative actions.

ThreatSense performs passive, evidence-based checks of public website and domain configuration only. We never log in to your systems, brute force, bypass authentication, crawl private areas, run exploit attempts or scan arbitrary IP ranges. Private IP addresses, localhost and cloud metadata endpoints are blocked.

The platform runs on hardened cloud infrastructure with continuous monitoring and automated alerting. We deploy via immutable infrastructure with signed artifacts.

We maintain a documented incident response plan with defined severity levels and escalation paths. In the event of a security incident, we will notify affected customers without undue delay and provide ongoing updates through resolution.

Security inquiries: security@threatsense.example.