Security
A tool that tests you should be able to answer this page.
Seccuti holds the results of penetration tests, which makes it a target in its own right. This is what protects it.
Platform controls
- Tenant isolation
- Enforced by row level security in the database, not by a filter in application code. A query that forgets its scope returns nothing rather than another tenant's data.
- Secrets
- Credentials and API keys are stored as sealed ciphertext and decrypted in memory only at the moment of use. They are never written to disk, to logs or to fixtures.
- Evidence and reports
- Held outside the public web path and served only after a permission check, so a link is not a key.
- Audit log
- Append-only. Actions, refusals and access to sensitive material are recorded and cannot be edited after the fact.
- Authentication
- Two factor authentication is available and is the user's choice. Sessions are invalidated everywhere when a password changes.
- Output handling
- Secrets are scrubbed from tool output before it is stored, so a credential cannot reach a log by way of a scanner.
If a control on this page matters to your procurement review, ask us to demonstrate it rather than accepting the sentence.
Bring your security questionnaire.
We would rather answer it than summarise it.