Trust

Security and your data

A security tool should be the safest thing to point at your site. These are the rules every scan follows. They are enforced in code, not left to good intentions.

Only sites you're allowed to scan

  • Nothing is scanned until you confirm, for that site, that you own it or have its owner's written permission to test it. We record that confirmation with the time, your IP address and browser.
  • Any site can be scanned only a few times a day across all accounts, and every request we send links to our abuse contact.
  • The request-by-request log of a scan is kept for 400 days, and for the latest scan of each site while the site exists. After that only the scan's totals remain.
  • You can also prove ownership with a DNS TXT record, a file under /.well-known/ or a meta tag, which unlocks deeper scans. The token is issued to you for that one site and expires after 7 days.
  • We check a proof again right before every scan. If it is gone, the site goes back to unverified and the scan does not run.
  • While verifying, we never follow redirects to other hosts.

What a scan does

  • A standard scan only sends GET, HEAD and OPTIONS requests. No forms are submitted and nothing is created, changed or deleted.
  • It only contacts the one host you added and never follows redirects. The one exception is backend checks, which are off until you turn them on for a site (see below).
  • Requests are limited to 3 requests a second (up to 10 for a site with an ownership proof), and every scan has a fixed request budget.
  • Scheduled scans need an ownership proof, which is checked again before each one, and run at night in the owner's time zone unless they pick another hour. A daily schedule sends a quick check of headers, cookies, TLS, exposed files and scripts, with a full scan once a week, so a monitored site gets a small fraction of a full scan's requests most days.
  • Your site's IP address is looked up once and pinned for the whole scan, and every connection is checked right before it is made. Private, internal and cloud metadata addresses are always refused.
  • Extra community checks (Nuclei) are limited to vetted, passive templates and go through the same rules.

What we keep

  • For each request: the address, status code and size. Every report shows a summary of them; on Pro and Ultra you can also see each request, one by one, and the scan log.
  • Evidence of a problem is stored masked, for example eyJhbG…(207 chars), never the full secret.
  • Response bodies never leave memory and are not stored.
  • An activity log of sign-ins, sites, verifications and scans, which you can see under Activity.

Who else we contact

  • A DNS resolver, to verify ownership and check your email records.
  • Only if you turn on backend checks for a site: the Supabase or Firebase project that site uses, with read-only requests and the public key already in your site's code, to see whether anyone can read your data. We never store what comes back, only a row count and column names.
  • OSV.dev, with the names and versions of the libraries we found, to look up known vulnerabilities.
  • crt.sh, with your domain name, to list other hosts in certificate logs. Those hosts are shown to you, never scanned.
  • ProjectDiscovery's anonymous version check for Nuclei, which carries no information about your site.

Your account

  • Passwords are stored as bcrypt hashes.
  • Sessions use HttpOnly cookies, and forms refuse cross-site submissions.

Found a problem or have a question? Email info@torvane.app.