OffSet7 / Security at OffSet7
How we protect your data
We hold sensitive leak data, so we apply the same controls to it that we recommend to our customers.
You only see your own exposure
Leaked passwords are shown only for an email or domain you have proven you own. On company plans every password reveal is written to the audit log.
Ownership first
We monitor or scan a domain only after its ownership is proven by DNS and reviewed by our team.
Tamper-evident audit log
Sign-ins, admin actions and access to sensitive data are recorded in a hash-chained log that shows any change.
Encrypted connections
All traffic uses TLS, including connections between our servers and databases.
Least privilege
Each internal service has its own account with only the permissions it needs; databases are not exposed to the internet.
Roles and permissions
Owner, admin, member and viewer roles for companies, with every permission checked on the server.
To report a security issue, email [email protected].