Trust & Security Architecture|Zero Compromise

We test other people’s security. Ours has to be better.

How Vulnetra protects your data, your assets and your reports.

TLS 1.3 & AES-256

Database Row-Level Isolation

India Data Residency Available

Zero Customer Data Sold

Request Security Pack Our Safe Scanning Rules

Platform Controls

Platform Security

Multi-layered defense engineered to safeguard your credentials, scanning telemetry, and confidential audit reports against unauthorized access and infrastructure threats.

AES-256 · TLS 1.3

Encryption

TLS in transit, encrypted at rest

All network traffic is encrypted via TLS 1.3 with HSTS preloading. Databases, customer records, and reports are encrypted at rest using AES-256 with managed KMS keys.

Controls in place:

Strict TLS 1.3 with forward secrecy
AES-256 on database volumes & object stores
Automated annual KMS key rotation

Row-Level Security

Tenant Isolation

Organization-level database separation

Customer data is isolated through organization-scoped database partitions and strict row-level security (RLS). No product query can cross tenant boundaries.

Controls in place:

Cryptographic tenant context per query
Enforced multi-tenant schema partitioning
Zero cross-organization data leakage paths

RBAC · 2FA · Scoped Keys

Access Control

Role-based access, 2FA & audit logs

Granular roles (Admin, Security Lead, Developer, Auditor) with mandatory multi-factor authentication, scoped API tokens, and immutable audit logs of every user action.

Controls in place:

Mandatory 2FA / WebAuthn hardware keys
Granular permission scopes per API key
Append-only audit trail for all events

Adaptive Rate Limits

Abuse Protection

Rate limiting on sensitive endpoints

Edge-level DDoS mitigation, token bucket rate limiting on authentication and scanning endpoints, and automated IP anomaly throttling.

Controls in place:

Edge-layer DDoS shielding via Cloudflare
Token-bucket rate limits on login & API
Automated credential stuffing detection

Signed URLs · Encrypted Storage

Protected Reports

Password-protected PDFs in private storage

Generated penetration testing reports are stored in private Cloudflare R2 object buckets, delivered via short-lived signed URLs, with optional document-level encryption.

Controls in place:

Expiring pre-signed download URLs (15-min TTL)
Zero public bucket access permissions
Optional client-side report password locking

SAST · SBOM · Peer Reviews

Secure Development

Code review and dependency monitoring

Mandatory peer reviews, static analysis (SAST), automated container vulnerability scans, and continuous Dependabot/Snyk software bill of materials (SBOM) audits.

Controls in place:

Two-engineer sign-off required on production PRs
Automated CI secret scanning on every push
Automated CVE dependency alert gating

Scanning Safeguards

Safe scanning — “Authorized testing only”

Automated scanning should never destabilize your production systems or test unauthorized assets. We enforce cryptographic ownership checks, isolated worker containers, and strict rate limits.

Required Gate

Ownership verification before any scan

We never probe third-party infrastructure. Targets must prove ownership before a scan can be initiated.

Enforcement Mechanism:

Automated verification via DNS TXT record challenge, hosted verification meta tags, or verified corporate domain email validation.

Strict Boundaries

Scope enforcement per scan

Engineers strictly confine automated workers to authorized hosts, paths, and CIDR blocks.

Enforcement Mechanism:

Kernel-level outbound firewall rules and custom DNS resolvers prevent traffic from escaping defined target boundaries or touching shared third-party dependencies.

Zero Downtime

Rate-limited, schedulable scan windows

Scans respect production stability with throttling controls and off-peak execution windows.

Enforcement Mechanism:

Configurable requests-per-second (RPS) limits, concurrent connection caps, and automatic pause triggers if response latency increases.

Ephemeral Compute

Isolated scanner workers

Scanning containers are short-lived, ephemeral, and destroyed immediately post-execution.

Enforcement Mechanism:

Every scan runs in an ephemeral container with zero inbound listening ports, isolated network namespace, and dedicated VPC routing.

Full Visibility

Full audit trail of scan activity

Every probe, user-agent string, and payload is logged for your SOC and engineering teams to inspect.

Enforcement Mechanism:

Real-time IP logs and custom `X-Vulnetra-Scan-ID` headers allow your security team to differentiate authorized security testing from malicious traffic.

Live Scanner Guarantee

Zero Production Outages

Our scanning engine tracks target response times dynamically. If p99 latency spikes by more than 25%, probe rates throttle automatically or pause until health restores.

Traceable Headers Sent:

X-Vulnetra-Scan-ID: vn_scan_9841

User-Agent: Vulnetra-SecurityScanner/2.4

✓ Source IP matches published scanner CIDR

Data Governance

Data Handling & Privacy

A vulnerability management platform handles sensitive security telemetry. Here is exactly what we store, who can see it, how long we keep it, and where it resides.

What We Store

Only what is required to track vulnerabilities and pass audits

Scan results, discovered vulnerabilities, and CVSS vector calculations
Technical proof of concept (PoC) HTTP request/response payloads
Remediation verification history and retest attestation records
Generated executive and technical PDF reports

We Never Sell Your Data

Zero monetization, zero AI training, strict human NDAs

We never sell, monetize, or broker your vulnerability data to third parties.
Customer findings and scan telemetry are never used to train public machine learning models.
Pentesters operate under strict non-disclosure agreements (NDAs) with least-privilege, time-boxed access.

Retention & Deletion on Request

Predictable timelines with written purge certification

Retention Policy:

90 days configurable retention for raw scanner traffic; 12 months for compliance audit evidence.

Deletion Commitment:

Complete data deletion upon request within 30 days across all primary databases and backups with written confirmation.

Data Location & India Residency

Regional boundaries tailored for regulatory compliance

Default Cloud Regions:

AWS & Cloudflare APAC & EU regions.

India Data Residency Option

If you require strict India-only data residency for DPDP Act or CERT-In compliance, specify 'India Data Residency' on the contact form, and all storage will be pinned to AWS Mumbai (ap-south-1).

Contact for India Residency

Third-Party Processing

Subprocessors

We partner exclusively with enterprise infrastructure providers bound by contractual Data Processing Agreements (DPAs). Here is the complete list of vendors who process customer data on our behalf.

Provider	Purpose	Region	Safeguards
Vercel	Web hosting and global edge delivery	Global / US East	SOC 2 Type II, ISO 27001
Neon	Serverless PostgreSQL database infrastructure	AWS ap-south-1 (Mumbai) / eu-central-1 (Frankfurt)	SOC 2 Type II, ISO 27001, AES-256 at rest
Cloudflare R2	Encrypted file and pentest report object storage	APAC / Global Edge	SOC 2 Type II, ISO 27001, private signed URLs
Hetzner	Dedicated API services and isolated scanner workers	Falkenstein, Germany / Helsinki, Finland	ISO 27001 certified data centers, ephemeral disks
Razorpay	Payment processing and GST-compliant invoicing	India	PCI DSS Level 1, ISO 27001

Change Notification Commitment

We will notify customers in writing at least 30 days prior to any material change or addition of a new subprocessor. Customers have the right to object within this 30-day window.

Full Vendor Register

Radical Transparency

Compliance status — “What we have, honestly”

Publish only what is true. Security buyers verify. We do not claim completed certifications before the ink is dry or hide behind vague marketing badges.

Assurance ItemIn Progress

SOC 2 Type II

Active observation period under Trust Services Criteria CC7.1 (Security) and CC6.1 (Access Controls). Readiness assessment completed.

Observation ending Q2 2026

Assurance ItemIn Progress

ISO/IEC 27001:2022

Information Security Management System (ISMS) controls established across development and scanner cloud perimeter. Stage 1 audit scheduled.

Certification target Q3 2026

Assurance ItemCompleted

Annual Third-Party Pentest of Vulnetra

Comprehensive manual grey-box penetration test executed by an independent CERT-In empanelled security consultancy covering platform, API, and worker infrastructure. 100% findings remediated.

Completed August 2025 · Retest cleared

Independent Verification Evidence Available Under NDA

If your vendor security team or compliance auditor requires our August 2025 third-party pentest report, remediation verification log, or SOC 2 readiness gap analysis, we provide it immediately under a standard mutual NDA.

Request Auditor Pack

Coordinated Disclosure

Responsible Disclosure

We actively support security researchers and the open-source offensive security community. If you identify a security issue in our platform or infrastructure, let us know and we will triage it rapidly.

Direct Security Contact

security@vulnetra.com

We acknowledge all vulnerability reports within 2 business days.

PGP Key Fingerprint (0x8F4E219B):

8F4E 219B C074 A18E 59D2 3120 7B18 90C4 4A6F D231

Published RFC 9116 Policy:/.well-known/security.txt

Safe Harbor Commitment

We pledge not to initiate or support legal action against security researchers who conduct testing within the rules of engagement and report findings in good faith.

Rules of Engagement:

Test vulnerabilities only against your own accounts or designated sandbox environments.
Do not access, modify, or destroy customer data or degrade service availability (no DoS/DDoS).
Allow reasonable time for remediation (minimum 90 days) prior to public disclosure.
Safe harbor: We will not initiate legal action against researchers acting in good faith under these guidelines.

View full scope parameters and out-of-scope vulnerability classes on /responsible-disclosure.

Vendor Review DeliverableUpdated for 2026 Procurement

Request our security pack

Everything your vendor review team needs: Security Architecture Overview, Data Processing Agreement (DPA), and standard questionnaire answers (CAIQ / SIG Lite).

Included in this security bundle:

Security Overview Whitepaper (Architecture, RLS, KMS)
Data Processing Agreement (DPA) with SCCs
Standard Security Questionnaire Answers (CAIQ & SIG Lite)
Third-Party Pentest Executive Summary & Attestation

Pre-filled CAIQ v4·SIG Lite Spreadsheet·Standard DPA + SCCs

Get Immediate Access

Enter your work credentials to receive the complete pack via email.