Built to be trusted by security teams

A tool that assesses security should be secure itself. Here is what protects your account, your data and the sites you assess.

Accounts

Accounts are created by an administrator. There is no open sign-up.
Passwords are stored with a slow, salted hash (scrypt).
Two-factor sign-in with an authenticator app and recovery codes.
Repeated wrong attempts lock the sign-in, without letting outsiders lock you out.

Sessions

Sessions end after 30 minutes idle or 12 hours in total.
A session is tied to the browser that signed in.
Sensitive admin actions ask for the password again.

Data

HTTPS only, with strict browser security headers and content policy.
Two-factor secrets are encrypted. API tokens are stored only as hashes.
You see only your own scans and reports.

Accountability

A tamper-evident audit log records sign-ins, scans and admin actions.
Monthly scan limits and rate limits per account.

Safe scanning

Public information only. No logins, no exploitation.
Every scan needs confirmation of ownership or written permission.
Requests to private or internal addresses are blocked.

Our honest position

DeepExpose has not yet had an independent security audit, and we would rather say so than imply otherwise. If you need our test results first, or want to run your own assessment, ask us.