How CyberScore handles your data, and what we never do
We sell a security product. The bar for our own posture has to be higher than the average SaaS, not lower. This page documents exactly what runs during a scan and how we handle anything we collect.
These badges link to live scan reports. Re-run them anytime — we display whatever grade the auditor returns.
Threat model in one paragraph
CyberScore performs passive external reconnaissance on a domain you provide. Every data source we query is publicly available without authentication; nothing about the target's internal systems ever crosses our network. Our threat model assumes that an attacker would query the same sources — our value is aggregation, prioritisation and a written brief, not privileged access.
What runs during a scan
Commitments
We never send exploit payloads, brute-force passwords, or interact with non-public endpoints. The only trace your WAF sees is the user agent CyberScoreBot/1.0.
You give us a domain name. We never request AWS keys, SSO access, GitHub OAuth on private repos, or any other authenticated integration. CyberScore stays domain-in / score-out.
Paid-plan scan results are kept for the lifetime of the active subscription or one-time entitlement. After cancellation or expiry, raw scan data is purged within 30 days. The "Sample preview" tier produces a demo report on a fixed target and is not tied to a real customer scan.
We do not sell or share scan data with advertisers, data brokers, or any third party outside of the public APIs we query during the scan itself.
CyberScore runs on a single dedicated VPS in France. Postgres, Redis, scan storage, and the FastAPI backend all live there.
TLS 1.2+ for every connection, bcrypt for password hashes, JWT auth with rotation, CSRF tokens HMAC-bound to the user, scan storage isolated to a dedicated VPS volume. Full disk encryption at rest is on the roadmap.
Reporting a vulnerability
Found something we got wrong? Email patrick@cybersco.re. We aim to acknowledge inside 24 h and triage inside 72 h. We do not yet have a formal bug-bounty program; pre-launch, recognition is the only reward we can offer, but we will list every reporter we hear from on this page when the program opens.
What stays out of scope
Honest disclosure of where CyberScore stops, so you know what it does NOT replace:
- Active exploitation. We never send real SQLi / XSS / RCE payloads that could trigger side effects on your servers. Vulnerability classes are surfaced via safe detection inputs, not confirmed by exploitation.
- Business logic flaws. Race conditions, IDOR on workflow-specific endpoints, broken price-calculation paths — these need a human pentester who understands your domain.
- Internal network recon. We scan the public attack surface from the outside. We don't pivot, we don't deploy agents on your servers, we don't access anything behind your VPN.
- Social engineering. Phishing simulations, prétexting, OSINT-driven human reconnaissance — not in scope and never will be.
- Source code review. SAST belongs in your CI. We scan the deployed surface, not the code that produced it.
These are deliberate boundaries. CyberScore is the continuous layer between two pentests— not a replacement for the deep, human-led pentest that catches the items above.
Coming next
- SOC 2 Type I — under evaluation, no firm date yet
- Public DPA available on request, signable in 1 click
- Public scanning IP range (so your WAF can allowlist us)
- Open-source CLI mirror of the passive scanners
Last updated June 21, 2026.