Security & trust
The safe path is the only path
A scanner that will point anywhere is a liability. ProbeIQ can only touch assets you have proven you own and signed off to test — enforced at every layer, recorded in a tamper-evident log. Standard scans identify exposure. Optional, bounded validation requires separate signed authorization and enablement.
Ownership
Verified before a packet is sent
Names are verified with a DNS TXT record; IP space with a signed attestation. Non-public addresses — private ranges, loopback, link-local (including cloud metadata), CGNAT and reserved space — are refused unconditionally, including when a hostname resolves to one.
Authorization
Signed rules of engagement
Scoped and signed
Each scope carries a signed authorization capturing intensity caps, rate limits, time windows, blackouts and an expiry date. Any edit to the assets or rules voids the signature.
Bounded and fail-safe
Scans run only inside the authorized window, at or below the allowed intensity, and stop automatically when an authorization expires or is revoked.
Enforcement
Defense in depth
Checked at every layer
The same authorization check runs at API create time, at dispatch, and on the worker immediately before an engine starts — not once, but every time.
Network-incapable of straying
Scan workers run behind an egress allow-list, so they are physically unable to reach anything outside your authorized scope.
Audit
Tamper-evident by construction
Every action is written to an append-only, hash-chained audit log — the database rejects updates and deletes, and the chain can be independently verified. It's the backbone of our SOC 2 evidence program, and your defensible record of exactly what was done, when, and under whose authorization.
Access
Least privilege, MFA from day one
Role-based access control (Admin, Analyst, Read-only, Report viewer) with granular permissions, and TOTP multi-factor authentication required for every account.
Security questions before you start?
We're happy to walk through the authorization and audit model in detail.
Talk to us