Security and trust at vul.ninja

We're a security company. We hold ourselves to the standard we ask of our customers.

How we access your cloud

vul.ninja takes a least-privilege approach to cloud access. We request the minimum permissions needed to scan your environment, and we never store long-lived credentials.

AWS

We deploy a read-only IAM role via CloudFormation. vul.ninja assumes this role via STS and receives short-lived session tokens — no long-term AWS access keys are ever created or stored. You can revoke access at any time by deleting the CloudFormation stack.

Azure

We connect via Microsoft Entra OAuth with Reader RBAC. OAuth tokens are short-lived and refreshed via the OAuth refresh token flow. You can revoke access at myaccount.microsoft.com/Permissions.

GCP

We connect via Google OAuth 2.0 with PKCE. No JSON service account key files are ever downloaded or stored. You can revoke access at myaccount.google.com/permissions.

Every API call vul.ninja makes against your cloud is logged in a full audit trail, downloadable from your dashboard. You can see exactly what we accessed, when, and why.

See how each cloud integration works

How we handle your data

What we store
  • Findings and scan results
  • Scan history and trend data
  • Your team's account details and settings
  • Audit logs of agent actions
What we don't store
  • Your cloud credentials or long-term keys
  • The contents of your cloud resources (S3 objects, database rows, etc.)
  • Customer PII from your cloud environment

Data residency

Your data is stored in AWS US-East-1. EU data residency is on our roadmap — contact us if this is a requirement.

Data retention

Findings and scan history are retained for 12 months on paid plans. You can export all data at any time from your dashboard.

Data deletion

You can delete your account and all associated data at any time from your dashboard settings. Deletion is permanent and completed within 30 days.

How AI agents handle your data

Scoped to your tenant

Agent calls are isolated to your account. Your findings and cloud configurations are never shared with or visible to other customers.

No model training on your data

We do not use your security findings, cloud configuration data, or any tenant-specific data to train or fine-tune AI models.

Write actions require your approval

AI agents can propose fixes, but every write action requires your explicit approval before anything touches your cloud infrastructure.

Every agent action — what it analyzed, what it proposed, what you approved or rejected — is logged and available in your dashboard.

Learn about our AI agents

AI safety & transparency

The specifics on how we handle your data when AI is involved — what we redact, which models we use, and how you can verify it all yourself.

What we redact before AI sees it
  • AWS account IDs and Azure subscription IDs redacted
  • Resource names SHA-256 hashed with an org-specific salt
  • Passwords, secrets, and tokens scrubbed from descriptions
  • Raw cloud-provider API responses stripped entirely
  • Optional: IP-address redaction per organisation

Every sanitized payload is re-scanned for leaks before it leaves our infrastructure.

Which models we use — and where
  • Claude Sonnet 4.6 for Investigation and Remediation agents
  • Claude Haiku 4.5 for Monitoring and lightweight triage
  • Via Anthropic's commercial API — their ToS prohibits training on customer data
  • AI inference runs in US-East-1 (Anthropic's AWS infrastructure)
  • NVIDIA Nemotron via OpenRouter as a fallback if Anthropic is unreachable

Want to verify any of this yourself?

We'd rather be audited than take your word for it. Customers and prospects can request any of the following:

Code access

Read the sanitization, audit-logging, and AI client code directly.

Audit-log export

Full CSV/JSON export of every AI call, with token counts and timestamps.

Security review

Live walkthrough with our team covering any AI-safety control you care about.

Request a review

Subprocessors

The following vendors may process customer data as part of delivering the vul.ninja service.

VendorPurposeData access
AWSCloud hosting and infrastructureAll customer data (encrypted)
Microsoft Azure / EntraAuthentication and identityUser account identifiers, auth tokens
StripePayment processingBilling information only
AnthropicAI model inference (for agent features)Finding descriptions, cloud configuration metadata

This list is updated as our subprocessors change. Last updated: April 2026.

Security FAQ

Contact our security team

security@vul.ninja

For vulnerability reports, security questions, DPA requests, or data deletion requests.

We acknowledge all security reports within 48 hours.

Send a security report

Secure by design. Transparent by choice.

Connect your cloud and see what we find — free.

Start free