Controlled access
Workspaces and their data are tied to an organisation. Sensitive actions are checked server-side and allocated according to roles.
AXISECURITY SECURITY
Service security is part of the service.
AxiSecurity is designed to provide usable diagnostics without turning a simple scan into an intrusive operation. Platform protection, organisation separation and test authorisation are operating requirements, not commercial options.
Bounded scans
The free scan performs external passive measurements. Active, authenticated or potentially impactful analysis requires verification and explicit authorisation.
Protected reports
Public reports omit sensitive detail. Downloads use temporary links and access to detailed remediation is subject to additional verification.
Limited data
Free-scan contact details are encrypted, IP addresses are not retained in clear text and data is purged according to a defined period.
Architecture and access separation
Assets, results, reports and authorisations are associated with the relevant organisation. Scan engines run in workers separate from the Web request that drives the interface. This reduces the risk that a public page, form or result view directly initiates a long or sensitive network operation.
Secrets, tokens and credentials supplied for an authenticated engagement must not appear in public pages, unprotected exports or application logs. Administration actions, status changes and authorisations are logged to support investigation and operational control.
What a penetration test is — and is not
A penetration test is a controlled engagement intended to assess the resilience of a defined scope. It is not limited to running a scanner: it involves a mandate, rules of engagement, exclusions, load limits, emergency contacts, a testing window and debriefing. Depending on scope, it may cover authentication, sessions, access controls, APIs, uploads, configuration errors and selected business scenarios.
Without a specific written agreement, it never includes denial-of-service, social engineering, disproportionate data collection, pivoting into third-party environments or modification of data. The platform may stop an action if target, scope or authority are not sufficiently established.
Data, cookies and privacy
Strictly necessary cookies help secure a session, remember a privacy preference and operate the journey. Analytics or marketing trackers, where they exist, remain optional and are not enabled by default. Details are available in the cookie policy.
The free scan collects only what is necessary for the requested service. The email address and telephone number associated with the scan are encrypted before storage; an IP fingerprint is used to prevent abuse without storing the address in clear text. The privacy policy explains purposes, recipients, retention and rights.
Reporting, remediation and continuous improvement
A red result indicates something considered dangerous for the executed control; orange indicates a configuration to investigate or strengthen; green indicates that a control completed satisfactorily within scan scope; grey represents a passive observation or a point to confirm: the check has run, but it never becomes compliant without sufficient evidence. Remediation must be validated before deployment, especially when it changes HTTP headers, TLS, cookie policy or server configuration.
To report a vulnerability affecting AxiSecurity, request a remediation quote or describe a controlled testing need, use the contact form. Do not include a secret or unnecessary personal data in the first message.