Security and data

Sign-in

You can sign in with Google, Microsoft, or Atlassian.
The sign-in service is PropelAuth.
An admin stores your email on Users.

Roles

The Users form can assign admin, user, viewer, manager, and analyst.

On the Users form, only admin can change Configurations, Alerting, and Users.
Other assigned roles see View only on those pages.
Ask another admin to change a role. Leave your own role unchanged.

Data you enter

On Configurations you store:

• Domains and keywords
• Integration match rules (host, path, or string)
• Vendor name, domain, and critical flag

On Users you store name, email, phone, and role.
On Alerting you store destination type, label, endpoint URL, and rule thresholds.

Secrets

An exposure is a leaked credential or sensitive value: password, secret, token, PII, PHI, credit card number, or similar.
The list shows type, file, repository, and severity.
The exposure list can show file preview context.

Alert webhooks include rule name, severity, confidence, title, repository link, and report id.
They omit the secret value. See Alerting.

Alerts

A matching report sends HTTP POST to your destination.
HTTP status below 400 counts as success.

Delivery is stored as an alert event (sent, partial, or failed).

API request log

The customer API writes an audit row for /v1/ requests.
A row includes actor, path, method, status, duration, client IP, user agent, and request id.
Health and docs paths are skipped.