Security

The browser talks only to our front door. The marketing site and the dashboard run on Vercel; every API request is proxied server-side to a private control plane that the public internet cannot reach directly. The autonomous engine runs in an isolated AWS account and is the only component that reaches your systems, and only within a scope you have verified and authorized.

Customer data — your account, findings, scan evidence and reports — is stored in AWS sa-east-1 (São Paulo) via Supabase and Amazon S3. For customers in other regions this is an international transfer; our Privacy Policy describes the safeguards that apply.

Data is encrypted in transit with TLS and at rest with AES-256 managed by our storage providers. Secrets and credentials you provide for authenticated testing are held in a sealed secret store and are never written into findings, logs or reports.

Access is governed by role-based access control with three layers: your organization’s membership and roles, per-member capability overrides, and server-side enforcement on every mutating request (row-level security scopes each tenant’s data). Panoptes staff access to customer data is limited to what is required to operate the service and is logged.

Panoptes captures masked proof of a validated finding — proof, not loot — never your exfiltrated data. Evidence is scoped to your organization. You can delete findings and their evidence from the dashboard, and on termination we delete your data within 90 days unless you ask us to do so sooner or the law requires us to retain it. Retention windows can be shortened by arrangement for an engagement.

Active testing originates from a small set of static IP addresses you can allowlist, so you always know that traffic is ours. One of them is 3.239.201.26; the full, current list is published in the dashboard and in each engagement’s Rules of Engagement before your first run. Passive scanners are read-only; anything intrusive runs only under a signed, per-run authorization, rate-limited and egress-confined.

We use a short list of infrastructure subprocessors to run the service. The current list, and how we give notice of changes, is at /legal/subprocessors.

If you believe you have found a security issue in Panoptes, email security@pnpts.com. We will acknowledge your report, keep you updated, and will not pursue good-faith research conducted under this policy. Please give us a reasonable time to remediate before any public disclosure. Our machine-readable policy is at /.well-known/security.txt.

Panoptes is not yet SOC 2 certified. We are building toward it and are targeting a SOC 2 Type I report in H2 2027. In the meantime we are glad to walk prospective customers through this page, our subprocessor list and a security questionnaire.

Security questions? Email security@pnpts.com. For anything else, contact@pnpts.com.