How we keep your trust data safe

Data residency: everything stays in the EU

The service is built, hosted and operated in the European Union. The application and its database run on servers in the EU, and so do the marketing site and lead handling. Your account data, scan history and evidence never leave the EU.

External by default

We scan your domains the same way an attacker, a mailbox provider or a browser would: from the outside. Mostly we read what is already publicly observable: DNS records, published certificates, TLS configuration and mail-authentication policy. On Pro and above, the exposure scan also checks whether a fixed list of risky ports answers on hosts under domains you have proved you own, after an administrator records consent: a plain connection, no login attempt, no exploit. None of this needs software on your systems, credentials or inbound access, so nothing we run can reach inside your network.

What the optional agents can and cannot do

Some optional features run software on your own hosts, so “no agent” is only true for the monitoring itself. Two add-ons install an agent: an internal discovery agent (Linux, plus a Windows build for AD CS) inventories certificates and keys that never appear on a public socket, and the Certificate Auto-Renew agent renews certificates in place. On Pro and above, a leaked-password audit script can also run on one of your Windows domain controllers. You install each of them yourself, only if you want it, and their scope is deliberately narrow:

• Outbound only. The agent opens every connection to us. We never connect in, and you never open a port for it.
• Metadata, not secrets. Discovery reports algorithm, key type and size, fingerprint, validity window, subject and issuer. Never a private key, never key material, never your traffic.
• Your keys stay yours. Auto-Renew drives the ACME client you already run; the private key is generated on your host and never leaves it. Only the public certificate chain comes back to us.
• Scoped credentials. Each agent carries its own token, bound server-side to your tenant and write-only to the ingest endpoint. A stolen agent token cannot read your findings and cannot touch another tenant.
• Least privilege on your host. The renewal agent runs as an unprivileged service user under a hardened systemd unit, and every value we hand it is validated against a strict character set before it can reach a shell.
• Counts, not passwords. The leaked-password audit compares password fingerprints with a public list of leaked passwords, on your domain controller. Only the first five characters of each fingerprint leave the server, to that public lookup service, or nothing at all if you use the offline copy of the list. SkyQon receives counts only and refuses any report that carries an account name or a fingerprint.

To be exact: monitoring gives us no path into your network, so a compromise of SkyQon cannot become a compromise of you. Running an agent or the audit script opens exactly one path to us (outbound, metadata or counts only), and it stays under your control: revoke the token or stop the service at any time, without asking us.

Encryption

All traffic to the dashboard and API is served over TLS. Credentials and connected-service tokens are encrypted at the application layer, and off-host backups are encrypted before they leave the server. Tenant data is isolated at the database level so one customer can never read another's findings.

Subprocessors

We keep the list of third parties that process data on our behalf short and EU-centered:

• Hetzner (EU): application and database hosting.
• Hostinger (EU): marketing site and lead capture.
• Brevo (EU): transactional and alert email.
• Paddle: payments and Merchant of Record; card data never touches our servers.
• Cloudflare: DNS, CDN and edge protection for our own domains.

Our privacy policy and Data Processing Addendum describe how each is used and the safeguards in place.

Access and authentication

Dashboard accounts support two-factor authentication (TOTP) and passwordless passkeys (WebAuthn), and a tenant can require 2FA for everyone. Sign-in is rate-limited and locks out after repeated failures. Administrative access to production is restricted and key-based.

Responsible disclosure

If you believe you have found a security issue in SkyQon, please tell us before disclosing it publicly. Email [email protected] with enough detail to reproduce it. We will acknowledge your report within three business days and keep you updated while we investigate. We will not pursue action against researchers who act in good faith, avoid privacy violations and data destruction, and give us reasonable time to fix the issue. Our machine-readable policy lives at /.well-known/security.txt.

Audit-ready evidence you can inspect

Frameworks like NIS2 expect you to show that certificate and cryptographic controls are working. The platform turns your scan history into a signed, reproducible NIS2 Article 21(2) evidence report, with an integrity hash an auditor can recompute and a precise map of what is directly evidenced, what is supporting, and what is out of scope. Rather than describe it, here is a real one generated by the product from our own infrastructure:

Download a sample NIS2 report (PDF)

What we don't claim

We would rather be precise than impressive. SkyQon is not currently SOC 2 or ISO 27001 certified, and we will not display a badge we haven't earned. What we do offer is an EU-native service, transparent engineering practices, and the same continuous checks we run for our customers, run on ourselves. We help customers prepare for their own ISO 27001 audit; we are not a certification body and never present our reports as a certificate. If your procurement process needs specific documentation, talk to us.

Run the same checks on your own domain

See also: how the Trust Score is calculated · system status · privacy policy.