Home / Private scanning
Private scanning
Your code never leaves the building.
The thing that stops most security deals is not the price. It is that the tool wants your source code. This is the answer to that, and it is built and running today, not on a roadmap.
How it is arranged
One direction only
runs on your hardware
never sees your code
You run one container inside your own perimeter. It calls out to us over HTTPS and accepts no incoming connections at all. There is no firewall rule to open, no VPN to terminate, and no open port for anyone to find. Not even us.
The agent copies your repository on your own hardware, drives your application from inside your network, and sends back findings. The code is read where it already lives, and is never transmitted to us.
The whole conversation
Four calls out. None in.
Your network team can read this list in ten seconds and check it against their own logs.
Enrol
Once, on first start. The agent trades a single-use token for a lasting key and is tied to your organisation from then on.
Heartbeat
A short "still here" message on a timer. It is what makes the agent show as online in the console, and nothing else.
Ask for work
The agent asks whether a scan has been queued for it. The queue never reaches into your network to push one.
Send results
Findings and their evidence, going out. Size-capped, so nothing can flood anything, and never containing your source.
That is the entire list. We port-scan our own agent container in our build pipeline on every release, so "no inbound ports" is a test that runs and can fail, rather than a sentence in a brochure.
Control
Who the agent is, and how you switch it off
A token used once
Create the agent in the console and you are shown an enrolment token exactly once. The agent swaps it for a lasting key the first time it calls home, and the token is dead after that.
Tied to you alone
The key resolves to your organisation and nothing else. An agent cannot see, claim or affect another customer's work, even by accident.
Locked to a version
The agent reports which build it is running. If it drifts away from the version we expect, it stops being given work rather than running something nobody has checked.
Off means off
Revoke the key in the console and the agent stops immediately. No rotation exercise, no waiting for something to expire.
You can see it is alive
The heartbeat drives an online light in the console, and a scan is never sent to an agent that has stopped answering.
Nothing is cached by us
Each scan gets a clean workspace on your own hardware. Whatever the agent reads stays on that machine, inside your network, under your retention rules. We never receive it, so we have nothing to cache, keep or hand over.
The AI part
Your key, your bill, your contract
Bring your own AI key
At every price, not only this one. The inference is billed to you by your own provider, under your own terms, with nothing added by us and no per-scan charge from us either.
Your own model, fully offline
Running the whole thing against a model you host, with nothing at all leaving your network, is the request we get most often from this page. We have not built it. We will say so until we have.
We will talk to your reviewers
If a security review board has to see the design before you can trial anything, we will walk them through it and answer the questionnaire ourselves. How the platform is built →
Even in the hosted version
What separates you from every other customer
Every customer's data sits in its own separate area of the database. A request is pinned to one customer for its whole life, and reaching another customer's records is not prevented by remembering to add a filter. Those tables simply are not reachable from that connection. For a security product, that distinction seemed worth the extra work. Read how it is built →
The price
$944 per app, per year
Private is the founding annual plus 35 per cent: everything in the founding plan, run by an agent inside your own network. Unlimited scans on every app you license, no per-scan billing anywhere on the price list, and your own AI key at every tier.
All prices exclude 18% GST, which applies to customers invoiced in India. International customers are invoiced without GST. The full price list →
Run it on your own hardware first.
Four calls out is a short list, and your network team will want to check it against their own rules. Bring them to the demo and we will walk the enrolment, the heartbeat and the revoke switch with them on the call.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.