Security
We build a security product; how we handle your data matters at least as much as what the product finds on your behalf. Here's what that means in practice.
Encryption in transit
Every connection to SurfaceDiff - the dashboard, the API, the marketing site - is served over TLS. There is no unencrypted path to any part of the product.
Passwords are hashed, never stored
Account passwords are hashed with bcrypt before they ever touch the database. We cannot see your password, and neither can anyone who gains read access to the database.
Tenant isolation by design
Every account only ever queries its own data - domains, incidents, exposures. Cross-account access is not a permission check bolted on afterward; it's the shape the queries are written in.
Session security
Sessions are signed tokens stored in httpOnly cookies - not readable by page scripts - scoped separately for customer accounts and internal operator access.
EU-hosted infrastructure
Application and scan data are hosted on infrastructure located in the European Union.
You control what we scan
SurfaceDiff only scans domains you explicitly add to your account, and you confirm you're authorized to monitor them - see our Terms of Service.
Found a security issue?
We take reports seriously and will respond promptly. Email support@surfacediff.com with details - please give us a reasonable window to investigate and fix an issue before disclosing it publicly.