Overview
Verusight handles sensitive credential exposure data. We take security seriously at every layer — from how we store your password to how we protect the breach data we detect.
Password Security
- Your password is never stored in plaintext — it's hashed using bcrypt with a high cost factor before storage
- We cannot view, retrieve, or reverse your password
- If you forget your password, you must reset it — we cannot "look it up"
Encryption
Data in Transit
- All traffic between your browser and Verusight uses TLS (HTTPS)
- Unencrypted HTTP connections are not accepted
- This includes API calls, authentication, and all dashboard interactions
Data at Rest
- Sensitive data stored in our database is encrypted using AES-256-GCM
- This applies to credential exposure data, tokens, and verification records
Session Management
- Sessions use cryptographically random IDs generated server-side
- Session cookies are configured with:
- HttpOnly — cannot be accessed by JavaScript, preventing XSS-based session theft
- SameSite — prevents cross-site request forgery (CSRF)
- Secure — only transmitted over HTTPS
- Sessions expire automatically after a period of inactivity
Credential Exposure Data
We want to be clear about how we handle the breach data we detect:
- We do not store plaintext passwords of exposed credentials in our reports — they are partially redacted in the database
- We do not hack or access any systems to obtain credential data
- We aggregate publicly available breach intelligence from known data sources
- Credential data in our reports originates from third-party breaches and info-stealer malware, not from our activities
Server-Side Validation
All inputs are validated on the server side — we never rely solely on client-side checks:
- Domain names are validated for format and TLD
- Verification tokens are validated before processing
- Payment callbacks are verified with our payment processor
- Email addresses are validated before sending verification codes