SaaS companies
An expired certificate, or a signup email that never arrives, costs revenue from the hour it happens. We warn you weeks before.
Explore
External trust monitoring
We watch your domains from the outside.
We check your certificates, DNS, email security and exposed services from outside your network, the way a mailbox provider or an attacker sees them. You get the exact fix for each gap, and a signed record once a later scan confirms it.
Live results in seconds. No signup, no email. Enter a public domain, like example.eu.
From 15 March 2027, public certificates last 100 days at most. What that means for you
No agent required
First scan in seconds
Based in the EU
Where do you want to go?
Integrations
Works with
SkyQon reads open standards and public vulnerability data, and sends findings to the tools your team already uses.
SBOM and vulnerability data
- CycloneDX
- SPDX
- OSV.dev
- NVD
- CISA KEV
- FIRST EPSS
Alerts
- Slack
- Microsoft Teams
- PagerDuty
- n8n
- Webhooks
Security operations and tickets
- Splunk
- Microsoft Sentinel
- Jira (by email)
- ServiceNow (by email)
- HaloPSA
Compliance platforms
- Vanta
- Drata
Cloud and DNS
- AWS Certificate Manager
- Cloudflare
- Amazon Route 53
- Azure DNS
Private certificate authorities
- EJBCA
- Microsoft AD CS
- HashiCorp Vault
- AWS Private CA
Sign-in
- Any OIDC or SAML provider, such as Okta or Microsoft Entra ID
- SCIM
Every connection listed is built into SkyQon today. Product names belong to their owners.
The trust layer
Most companies monitor their apps. Few watch how the outside world sees their domain.
A mailbox provider checks DMARC, a browser checks certificates and an auditor checks evidence. We look at your domain from all three angles and turn what we find into work your team can plan.
Email Trust
SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT and spoofing exposure.
DNS Trust
DNSSEC, DANE, nameserver health, risky records and DNS hygiene.
Certificate Trust
Expiry, issuer changes, inventory and renewal risk.
TLS Security
Protocols and ciphers on every endpoint, old TLS versions and web security headers. Full TLS detail from Pro.
Attack Surface & Exposure
Open ports, web software older than the maker’s security release (PHP and others), building controllers and AI services.
Brand Protection
Lookalike domains, typosquatting and phishing infrastructure.
Registrar Monitoring
Lock status, nameserver and WHOIS changes, expiry dates.
Compliance Evidence
Exportable NIS2 / audit evidence and board-ready reports.
Cloud & internal coverage
Extend with cloud connectors and an optional internal agent.
Fix first, fix right
Each finding comes with the steps to fix it.
We turn DNS, email, certificate and TLS findings into remediation steps your team can complete.
- Plain-language explanation of every finding
- What it costs the business if left unfixed
- Exact DNS fixes with copy-paste-ready records
- One-click verification once you've applied a change
- Before / after view of the score impact
FINDING · EMAIL TRUSTHIGH
DMARC policy is p=none
Add an enforced DMARC record so spoofed mail from your domain is rejected.
DNS · TXT · _dmarc.yourdomain.com
_dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=s; aspf=s"
Digital Trust Score before: 71After fix: 79
A number you can defend
The Digital Trust Score, not a vanity number.
We separate what we checked from how secure you are, so a single weak control never hides behind broad coverage.
The free check gives one domain a Domain Check Score. The Digital Trust Score covers everything you monitor.
See how it is calculated01
96%
Scan coverage
How much of your domain estate we have inspected.
02
71%
Security posture
How strong the controls are across everything we inspected.
03
77
Digital Trust Score
Derived from coverage and posture, with both inputs always shown.
Proof, built in
Don't take our word for it. Verify a report yourself
Every report is digitally signed (PAdES) and carries a SHA-256 content hash. Anyone you share it with can check its integrity on our public verifier, no account needed.
Find, fix, prove
We find it, help you fix it, and prove it was fixed.
An alert on its own fixes nothing. Each finding comes with the exact change to make. For certificates, our agent can do the work on your own server once you approve it. Every fix that a later scan confirms goes into a signed record.
outside-in detection
CT LOGS / OCSP / CRL
01
Find
Certificates, TLS, email, DNS and exposed services are checked the way the outside world sees them, including certificates that were revoked but are still being served.
On every plan, no agent neededreplace before revoke
ACME / PRIVATE KEYS STAY ON HOST
02
Fix, with your approval
Certificate Auto-Renew runs ACME on your own server, so the private key never leaves it. Private CA Management checks, issues and revokes on the CA you run yourself. When a certificate has to go, the replacement is installed before the old one is revoked.
Certificate Auto-Renew Private CA Management
Private keys stay on your serversevidence ledger
SHA-256 / PAdES
03
Prove it was fixed
When a later scan no longer sees a finding, the fix is written into a signed, hash-chained record your auditor can check. A finding that was only hidden, such as a version number a server stopped showing, is not counted.
Recorded and verifiableBuilt and operated in the EU
Built by people who run production trust infrastructure
SkyQon is built and operated in the EU by engineers who run production PKI, EJBCA certificate authorities and eIDAS-aligned trust services for a living. The scoring rules, the evidence formats and the fixes come from that operational practice.
32
EU & EEA trust-list territories tracked
5,000+
qualified trust services verified against the official lists
< 3 min
to your first scored report
< 0.3 s
from revoking a certificate to the client being refused, measured in our lab
For every team that owns a domain
Each team worries about something different
Each of them gets what matters to them from the same view, without yet another dashboard to look after.
MSPs & IT providers
Watch every client domain from one account and hand each client a report with their name on it.
ExploreSecurity teams
Your EDR does not read DNS zones. Spoofing and takeover risk live in that blind spot.
ExploreCompliance teams
NIS2 Article 21 asks you to show working controls. Export the evidence, signed and reproducible.
ExploreAgencies
When a client's certificate lapses, the call comes to you anyway. Better to hear about it from us first.
ExploreExecutives
Know your score before the auditor or the enterprise buyer asks for it.
Run a free check
Design partner program
Ten design-partner seats for Benelux teams
The Digital Trust Center is live and self-serve. The design-partner program is something extra: direct time with the engineers who build it and early input on the roadmap, in exchange for honest feedback. If you operate domains that matter, we would like to hear from you.
Questions, answered
Questions we often get
No jargon, no mystery scoring, no compliance theatre. Just the information your team needs to act.
Still have a question? Talk to usWhat does the Digital Trust Center do?
It continuously monitors your domain trust posture: email authentication (SPF, DKIM, DMARC), DNS security, TLS and certificates, attack surface, compliance evidence and post-quantum readiness.
Do I need to install anything?
No. Monitoring is agent-less by default and runs from the cloud. The inline scan shows live results in seconds, and your first full monitoring scan completes within minutes of adding a domain. For deeper reach, optional cloud connectors and an internal agent are available on higher tiers.
Who is it for?
Businesses that own public domains: SaaS companies, security and compliance teams, MSPs and agencies. In short, any team where a lapsed certificate or a spoofed email becomes an incident.
Is there a free option?
Yes. The Free plan monitors up to 5 domains continuously at no cost and gives you a unified Trust Score with your top findings. No payment details needed to start. Every new account also begins with 14 days of Pro included; after that it moves to Free automatically, with nothing charged.
How is pricing structured?
Plans are monthly or annual subscriptions billed in EUR or USD, from Free at €0 to Growth at €599/mo. Enterprise is priced for your environment. The pricing page lists what each tier includes.
Start with the outside
Run the first scan now.
You get a scored report in under three minutes. There is nothing to install, and we're based in the European Union.