Skip to content

TRUST · SECURITY

Security and trust,
held to the standard we ask of you.

You are trusting us to place decoys in your environment and, if you choose, to act in it. Here is exactly how we protect your data and our platform, in plain language, with nothing claimed that we do not hold. We are an early-stage company: what is active is active today; the rest is on a clear path.

GDPR

Active

UK and EU GDPR controller and processor. DPA published.

NIS2-aligned

Active

Product and practices map to NIS2 incident duties.

EU data residency

Active

Core data plane runs in the EU.

Cyber Essentials

In progress

In progress through the Eastern Cyber Resilience Centre.

THE CONTROLS

What is in place, control by control.

Data protection

  • TLS 1.2+ in transit, encryption at rest everywhere
  • AES-256-GCM for connected integration credentials
  • Exposure evidence encrypted with a key unique to each workspace
  • Integration secrets are never returned to the browser
  • Sensitive headers stripped before storage

Infrastructure and residency

  • EU data plane: Supabase EU, Railway EU-West, Upstash and Resend in Ireland
  • Cloudflare WAF, CDN and DDoS protection
  • Strict per-tenant isolation, enforced in the database
  • Limited US enrichment and AI sub-processors under UK IDTA and EU SCCs

Application security

  • Strict Content-Security-Policy, no third-party scripts
  • HSTS with preload, HTTPS enforced
  • Clickjacking and MIME-sniffing protections
  • Statically prerendered site, no runtime code from CDNs
  • Continuous error monitoring

Access and authentication

  • Managed authentication provider
  • Optional two-factor authentication
  • Least-privilege access to production
  • Our staff cannot see your exposure data by default; every access needs a written reason and is logged for you

Architecture and response

  • Agentless, nothing deployed on your servers or network
  • Outbound-only triggers, no inbound connections
  • The optional browser decoy (early access) holds one fake session: no access to your real cookies or browsing, no remote code, no analytics
  • Exposure checks are read-only, on domains you proved you control
  • Destructive containment runs on rules you pre-authorised, never on an LLM's judgement

Privacy and data handling

  • We never sell personal data
  • Published retention ceilings, enforced in the database
  • Raw evidence kept 30 days, no exception
  • Transparent sub-processor list with 30 days' notice of changes
  • Deletion with a receipt

SUB-PROCESSORS

Who we rely on.

The vendors that help us run Vantuz. Purposes, locations and transfer safeguards are detailed in the Privacy Policy and the DPA. Accounts you connect are yours, not sub-processors.

Sub-processors8 vendors
SupabaseAuthentication and databaseEU
RailwayApplication hostingEU · Amsterdam
VercelSite hostingGlobal edge
CloudflareDNS, CDN, WAFGlobal edge
UpstashJob queueIreland
ResendTransactional emailIreland
AnthropicAI incident narrative (never exposure data)US · safeguards
VirusTotal, AbuseIPDB, ShodanIP reputation enrichmentUS · safeguards

DISCLOSURE

Found something?

We welcome responsible disclosure. If you believe you have found a security issue, email us and we will respond quickly. Please give us reasonable time to fix it before any public disclosure.

See also /.well-known/security.txt