Security at Scantelio
Implemented controls and their limits — without unsupported certification claims.
Test credentials and integration secrets
Test credentials use AES-256-GCM envelope encryption bound to workspace and authentication-profile identifiers. Production code requires AWS KMS for this vault; the local key provider is disabled in production. Integration credentials are encrypted separately with an operator-managed master key. KMS configuration and deployment permissions must be valid for credential features to operate.
Access to results
API access is scoped to workspace membership and project authorization. Roles restrict writes. Superadmin access is checked separately; administrative changes are audited. Reports are not published as public links. Support attachments are private to the authenticated author and superadmins; guest attachments are visible only to superadmins.
Sessions and data in transit
Production session cookies are HttpOnly, Secure and SameSite=Lax. Session-authenticated changes require the configured application origin. The deployment provides HTTPS through its reverse proxy; do not send credentials to an unencrypted installation.
Testing boundaries
DNS/file target verification and explicit consent are required before scans. Staging-only scenarios have additional consent and fixtures. Network and request budgets constrain scans. These safeguards reduce misuse; they do not replace your legal authority to test.
Retention and deletion
Terminal scan runs are removed according to the current plan retention setting. Deleted projects become eligible for background purge after 24 hours; completion depends on the maintenance worker. Analytics events are purged after 365 days. Support requests and backups have separate lifecycles; contact us to request deletion. We do not promise instant removal of all copies.
Report a security issue
Contact owner@scantelio.com with the affected feature and a minimal safe reproduction. Do not access another customer’s data or run disruptive tests. We do not claim SOC 2 or ISO certification or guarantee an absolute level of security.