Security at VectraGuard

Built like a target.

A pentest platform holds the most sensitive data a customer can hand over. Here is how VectraGuard is actually built, stated plainly and specifically.

Hard tenant isolation

Your data is separated from every other customer at the database layer, not just in application code.

PostgreSQL row-level security enforced on tenant tables
Org scoping checked again in every application query
Object-level ownership checks on all mutations

Encryption in transit and for stored secrets

Transport is TLS everywhere. Stored credentials and MFA secrets get dedicated application-level envelope encryption.

AES-256-GCM for stored credentials and MFA secrets
HSTS and strict security headers on every response
HttpOnly, Secure, SameSite=Strict session cookies

Authentication that resists abuse

Short-lived sessions, enforceable MFA, and password handling that assumes attackers have the breach corpora.

TOTP MFA, enforceable across an organization
OIDC single sign-on with domain allowlisting
Passwords bcrypt-hashed and checked against known breaches
15-minute access tokens with rotating refresh, lockout after repeated failures

Sandboxed scan execution

Scanners do hostile work, so they run with no privileges and no blast radius.

Engines run in containers with all capabilities dropped
No-new-privileges enforced, hard memory limits per engine
SSRF protections block internal and cloud-metadata ranges

Every action on the record

A complete, exportable audit trail covers the platform, and outbound automation is cryptographically attributable.

Audit log of user, IP, action, and outcome per request
Webhooks signed with HMAC-SHA256, with key rotation support
Rate limiting on authentication and scan creation

Your data, your call

Data portability and deletion are product features, not support tickets.

Self-serve full account export (GDPR Article 15)
Self-serve account erasure (GDPR Article 17)
Plan-based retention with automatic cleanup

Compliance

Certifications, without the theater.

We publish our security architecture above because it is verifiable in how the product behaves. Formal certification status: ask us directly and we will tell you exactly where we are, including what is in progress. We would rather show you the real state than a badge wall.

Disclosure

Responsible disclosure

If you find a vulnerability in VectraGuard, we want to hear about it. Send a detailed description and reproduction steps and we will respond as quickly as we can. We will not pursue legal action against researchers who act in good faith and give us reasonable time to fix.

[email protected]

Early access

Ask us the hard questions.

Security review underway? Send your questionnaire. We answer it ourselves, specifically.

Request early access Talk to us