How we protect your data,
and how we scan safely.

Last updated 9 October 2026

You give us permission to test your production systems, and sometimes a session to log in with. Here is where that data lives, who can see it, and the rules our scans follow. If your vendor review asks something this page does not answer, email [email protected].

Where your data lives

• The portal, the scan engines, and the databases run on infrastructure we operate ourselves in Sofia, Bulgaria, inside the EU.
• Each client's scan results, reports, and evidence are kept apart from every other client's, in a separate workspace and separate storage spaces. Portal sessions and API keys only reach their own workspace.
• Backups are encrypted and copied off the production server.
• When you stop being a client, we delete your workspace and scan data on request and confirm it in writing.

Credentials you give us

Authenticated scans need a bearer token or session cookie, and service checks need usernames and passwords you supply.

• Session details are given to the scan as a separate file, not stored in the scan profile: the profile records only that a scan is authenticated.
• Please give us a dedicated test account or a short-lived token, never a personal or administrator login. Revoke it when the engagement ends; we delete our copy at the same time.
• Never send credentials by plain email. We agree a secure way to exchange them before the first authenticated scan.

Access to the platform

• Portal sign-in: each client uses a random 256-bit access key. We store only a one-way digest of it, so it cannot be read back, even by us. Sessions expire within eight hours.
• API keys for AI assistants are read-only, scoped to your workspace, can expire, and can be revoked by you at any time in the portal.
• Administration is not reachable from the internet. Admin functions are blocked on the public interface and available only from our internal management network.
• All traffic to the website, portal, and API is encrypted with TLS.

Scan authorisation

We only scan systems you have shown you control, and the platform enforces it, not just a policy document.

• Domain verification. In the portal, you add each host and publish a one-line file at /.well-known/auditon-verification.txt. The portal checks it over HTTPS before the host can be scanned, and re-checks it about once a week. If the file disappears, scans of that host pause.
• Written authorisation. Hosts that cannot carry the file, such as IP addresses, are authorised by us against a signed scope letter, and the authorisation is recorded with the host.
• Blocked by default. A scan that includes any host that is not verified or authorised does not start. It is recorded as blocked.

Rules of engagement

• Scans run on the schedule and within the time windows you agree, and are rate-limited to avoid load on production.
• Our scan tools check their targets against the approved hosts, ports, and application origin before sending requests.
• Destructive tests are off unless you ask for them, and then only against an environment you nominate.
• We can stop any scan immediately. Contact [email protected] if a scan affects your service.
• To allowlist our scanners in your firewall or WAF, ask us for the current source address. We confirm it before your first scan.

Subprocessors and data protection

For personal data in your scan results, you are the controller and we are the processor. We process it only to provide the service, under a data processing agreement (GDPR Article 28). Ask us for a copy.

We will tell clients before adding a subprocessor that handles their data. How we handle data from this website is in our privacy notice.

Certifications and compliance

We are implementing an ISO/IEC 27001 information security management system, and its documentation is under way. We are not certified yet, and we will publish the certificate here when we are. In the meantime we are happy to answer your security questionnaire.

Auditon helps you produce evidence for controls such as ISO 27001:2022 Annex A 8.8 and SOC 2 CC7.1. That is not an attestation: your auditor decides what satisfies a control.

Report a vulnerability

If you find a security issue in auditon.co or the client portal, email [email protected] with "Security report" in the subject. We reply within two working days and will not take legal action over good-faith research that avoids other people's data and does not disrupt the service. Details are also in our security.txt.

Want to know who is behind Auditon? See About us.