Tenant isolation
Every read and write is bound to a tenant and provider resolved server-side from the session.
SECURITY
Security practices
Each control is listed with its real status. A roadmap item is never shown as live, and no certification is claimed that is not held.
Server-side authorization
Role, plan, entitlement and approval requirements are evaluated on the server; the browser is never the authority.
Credential vault
Connector secrets are stored in a vault, referenced by handle, and never echoed into the UI or logs.
Encryption in transit
Public traffic and machine endpoints are served over TLS.
SSRF defence
Scan targets are resolved before they reach the queue; private ranges, metadata endpoints and unsafe redirects are refused.
Rate limits and budgets
Scan budgets, rate limits and cost ceilings are enforced server-side.
Audit trail
Significant operations are appended with an actor, correlation id and record hash.
Approval workflows
Approval queues for restricted write actions are being rolled out with the actions surface.
Step-up assurance
Sensitive operations require re-verification before they execute.
Backup and restore
Operational backup and restore procedures are being formalised; status is published here as each is confirmed.
Third-party certification
VENRAC holds no security certification today and does not claim one. Any future certification will be published with its scope and date.
To report a vulnerability, see /vulnerability-disclosure.