Security at VeilScan

Security is not a feature we add on top of VeilScan — it is the reason VeilScan exists. We hold ourselves to the same standard we help our customers achieve.

What about infrastructure?

Hosting and data processing

Scan results, reports and findings are stored on infrastructure operated by VeilScan. Some finding details are sent to third-party AI model providers to help write reports, and these providers may process data outside the UK and the EU. The full list of sub-processors is in our Privacy Policy.

Scan scope controls

Scope validation runs before and during every scan: requests outside the signed Rules of Engagement are rejected, so a scan only reaches the customer's authorised target scope. Scans run on shared worker infrastructure as unprivileged, resource-limited processes.

Encryption

• In transit: TLS 1.2+ enforced on all endpoints. HSTS headers set.
• At rest: RDS storage encrypted with AES-256. S3 reports encrypted with SSE-S3 (AES-256). Sensitive database fields (API keys, tokens) encrypted at the application layer with Fernet symmetric encryption before storage.
• Secrets: All API keys, database credentials, and tokens are stored in AWS Secrets Manager — never in environment variables or code.

What about authentication and Access Control?

VeilScan uses email-verified sessions for customer authentication. No passwords are stored — session tokens are generated on login and stored as HttpOnly, Secure, SameSite=Lax cookies. Sessions expire automatically.

Access to production infrastructure is restricted to named engineers via MFA-protected AWS IAM roles. We follow the principle of least privilege throughout.

What about scan Safety?

We take precautions to ensure our scanning does not harm customer systems:

• Scans are external and non-destructive — we validate exposed internet-facing behaviour without authenticated or internal testing
• Rate limiting is applied to all probe operations to avoid triggering DDoS protections
• Scope validation runs before every scan — requests outside the signed Rules of Engagement are hard-rejected
• A time limit is enforced on every scan
• Every scan action is logged to CloudWatch with a tamper-evident audit trail

Customer use is also governed by our Acceptable Use Policy, including strict limits on unauthorised scanning.

What about vulnerability Management?

We maintain a vulnerability disclosure programme. If you discover a security issue in VeilScan:

• Email support@veilscan.net with details
• Include steps to reproduce, impact assessment, and any proof of concept
• Give us a reasonable time to remediate before public disclosure (we ask for 90 days)
• We will acknowledge receipt within 24 hours and keep you updated on our progress

We do not pursue legal action against researchers acting in good faith under these guidelines.

What about data Handling?

Customer scan data is confidential. We do not sell or publish findings. Finding details are shared only with the sub-processors listed in our Privacy Policy, which process them on our behalf. Scans for different customers can run at the same time on shared worker infrastructure. Results are stored against the customer that requested the scan. Our full data handling practices are described in our Privacy Policy.

What about compliance?

VeilScan is built with compliance mapping for ISO 27001, GDPR, SOC 2, PCI DSS, and Cyber Essentials. We are working toward Cyber Essentials certification for our own infrastructure. Our data processing is conducted under UK GDPR with the ICO as our supervisory authority.

What about incident Response?

In the event of a security incident affecting customer data, we will notify affected customers within 72 hours of becoming aware of the breach, in line with UK GDPR requirements. Notifications will be sent to registered account email addresses.

What about contact?

Security issues: support@veilscan.net
General enquiries: hello@veilscan.net
CodeCrypse IT Solutions LTD, England & Wales