Legal
Security
We are asking you to point a security tool at your own systems. The reasonable response to that is suspicion, so here is what each product holds, what it can do with it, and what it is structurally unable to do.
Last updated 24 August 2026
Credentials
What we hold, per product
KeyDrift holds no credential
KeyDrift reads what your site already serves to every visitor: the page and the JavaScript files it links to. It has no agent, no repository access and no API token. It cannot see anything a person with your URL could not see.
How to revoke — Nothing. There is no credential to revoke.
RowShield holds a Postgres connection string
For continuous monitoring you create a database role and give us its connection string. Give it catalog read access and nothing else — the scanner reads structure, not contents, so a role that can select from your tables is more access than it needs.
The string is encrypted before it is stored, using a data key that is itself wrapped by a key-management service, and bound to your organization and project so a ciphertext moved to another tenant simply fails to decrypt. It is decrypted only inside the scan worker, for the length of a scan.
The free audit holds nothing. It accepts the publishable key your app already ships to browsers, uses it for that one request, and stores neither the key nor the result.
How to revoke — Revoke the database role, or disconnect the project.
FeeGuard holds a Stripe API key you restrict
FeeGuard asks for a restricted key with five read permissions: charges, transfers, application fees, balance and events. Two write permissions exist and are optional — they enable automatic recovery of a reversal, and detection works fully without them. A full secret key will also work, and the interface warns you that it is more access than the job needs.
The key is encrypted with a key derived per tenant before it is written, stored in columns that the application’s own database roles are explicitly denied access to, and never returned to your browser. Permission detection never mutates your account: write scopes are probed with a request that is invalid by construction, so Stripe answers “you lack permission” or “that object does not exist” without anything being created.
The free audit accepts no key at all. It works on event data you paste, because an unauthenticated form collecting credentials has no audit trail and no way to revoke.
How to revoke — Roll or revoke the key in your Stripe dashboard. It stops working immediately.
By construction
What the scanners cannot do
They cannot write
The fetch layer in both web scanners rejects any method other than GET and HEAD, and RowShield’s database scanner runs a fixed set of catalog queries with no insert, update, delete or alter anywhere in it. Remediation SQL is generated as text for you to run; we never execute it.
They cannot be pointed inside your network
Requests to loopback, private, link-local, carrier-grade NAT and cloud metadata addresses are refused before a socket is opened, and re-checked on every redirect hop. Hardening against DNS rebinding belongs to the egress layer and we do not claim it here.
They cannot store a live secret
A discovered key is reduced to a short mask and a salted hash at the point of detection. There is no column in the schema that can hold a live credential value, so there is nowhere to put one by mistake.
They cannot read your rows into storage
RowShield’s audit asks a table for one row to learn whether it is reachable, then keeps only the column names and the count. The values are not returned to you, not logged, and not written anywhere.
Encryption and access
In transit. Everything is HTTPS. The sites send HSTS with a two-year max-age and are preload-eligible, refuse to be framed, and turn off MIME sniffing.
At rest. Customer databases are managed Postgres with provider-level disk encryption. Credentials get a second layer on top of that: AES-256-GCM with a per-tenant key, so reading the disk is not enough.
Between tenants. Row-level security separates organizations, and the columns holding credentials are additionally revoked from the roles the application uses for normal queries. Audit records strip those columns before anything is written to them.
Sign-in. Magic links and provider-managed authentication. We do not store passwords.
In logs. Credential-shaped values are replaced with a fingerprint before anything is logged, and error messages returned to anonymous callers are mapped to a fixed set of phrases so a resolved address or an internal hostname cannot leak through a failure.
Keeping and deleting
Scan history belongs to the account that created it and goes when the account goes. Disconnecting a project or a Stripe key clears the stored credential immediately and writes an entry to the account’s audit trail.
Scans run without an account are kept until you ask us to remove them — we have not built an automatic expiry, and we would rather say that than publish a retention period we do not enforce. Ask and we delete, including the public report page.
The full picture, including what each product stores from a scan, is in the privacy policy.
What we do not claim
We hold no security certification. No SOC 2 report, no ISO 27001, no PCI attestation — and we will not imply otherwise on a sales call. The company is weeks old. What we can offer instead is that every control on this page is checkable, and that our products are built so that the worst-case version of us still cannot write to your systems.
We also do not run a bug bounty program yet. If that changes it will be announced here first.
Disclosure
Reporting a vulnerability
Email info@useveristria.com with “Security report” in the subject. Tell us what you found, how to reproduce it, and how you would like to be credited. We acknowledge within a few business days, agree a disclosure timeline with you, and credit you when it is fixed unless you would rather stay anonymous.
In scope: the four sites and the infrastructure behind them. Please do not run automated scanners at volume against production, do not access data belonging to anyone else, and stop as soon as you have proved the point. We will not pursue anyone who reports in good faith and stays within that.
KeyDrift keeps a longer version of this at keydrift.dev/docs/security/responsible-disclosure.
Each product goes deeper
This page is the family summary. The product security pages state the same controls against the specific code that implements them.