How we protect your data and keep the platform secure.
All sensitive credential data is encrypted using AES-256-GCM before being stored. Encryption keys are managed separately from the database and never logged or exposed.
User passwords are hashed with bcrypt using a high cost factor. We never store or transmit passwords in plaintext — not yours, and not the exposed credentials we detect.
Sessions are managed server-side using cryptographically random identifiers. Cookies are HttpOnly and SameSite-protected to prevent XSS and CSRF attacks.
All traffic is served over HTTPS with TLS encryption. Our application runs in isolated containers with a minimal footprint, and all external-facing inputs are validated and sanitized server-side.
All sensitive endpoints are rate-limited to prevent brute force attacks and abuse. Domain verification, scan requests, and authentication flows all have per-user and per-IP limits.
We verify domain ownership before revealing any exposure data. Verification is required via DNS record, file upload, or email match — ensuring only authorized parties can access breach reports.
Found a vulnerability? We appreciate your help keeping Verusight secure. Please report security issues to [email protected]. We will respond within 48 hours.