How CyberScore handles your data, and what we never do.
We sell a security product. The bar for our own posture has to be higher than the average SaaS, not lower. This page documents exactly what runs during a scan and how we handle anything we collect.
Threat model in one paragraph
CyberScore performs passive external reconnaissance on a domain you provide. Every data source we query is publicly available without authentication; nothing about the target's internal systems ever crosses our network. Our threat model assumes that an attacker would query the same sources — our value is aggregation, prioritisation and a written brief, not privileged access.
What runs during a scan
Commitments
We never send exploit payloads, brute-force passwords, or interact with non-public endpoints. The only trace your WAF sees is the user agent CyberScoreBot/1.0.
You give us a domain name. We never request AWS keys, SSO access, GitHub OAuth on private repos, or any other authenticated integration. CyberScore stays domain-in / score-out.
Free Scan results are kept for 24 hours. Paid-plan results are kept for the lifetime of the active subscription. After cancellation we purge raw scan data within 30 days.
We do not sell or share scan data with advertisers, data brokers, or any third party outside of the public APIs we query during the scan itself.
CyberScore runs on a single dedicated VPS in France. Postgres, Redis, scan storage, and the FastAPI backend all live there.
TLS 1.2+ for every connection, bcrypt for password hashes, JWT auth with rotation, CSRF tokens HMAC-bound to the user, scan storage isolated to a dedicated VPS volume. Full disk encryption at rest is on the roadmap.
Reporting a vulnerability
Found something we got wrong? Email patrick@cybersco.re. We aim to acknowledge inside 24 h and triage inside 72 h. We do not yet have a formal bug-bounty program; pre-launch, recognition is the only reward we can offer, but we will list every reporter we hear from on this page when the program opens.
Coming next
- SOC 2 Type I — under evaluation, no firm date yet
- Public DPA available on request, signable in 1 click
- Public scanning IP range (so your WAF can allowlist us)
- Open-source CLI mirror of the passive scanners
Last updated May 7, 2026.