Security & trust

Last updated 8 July 2026

BreachLens is a security product, so we hold ourselves to the standard we ask of our customers. The most important fact: BreachLens is self-hosted by design — your source code, scan results, and findings stay on infrastructure you control. We (the company) never receive them.

Architecture: your data never leaves your infrastructure

BreachLens runs as a single stack on your own cluster. Scans execute on your infrastructure and findings are stored in your database. There is no required call-home, and no copy of your code or results is sent to us.

Offline & network-restricted deployment

BreachLens is built to run in restricted and disconnected networks. Your source, findings, exploit evidence, and AI inference stay inside your boundary — AI runs on a local model, and no vendor cloud sits in your trust boundary. The scanners draw on public vulnerability data (CVE feeds, rule and template sets); for a fully disconnected deployment those are mirrored inside your network — talk to us about offline provisioning for your environment.

Access & authentication

• Single sign-on via OIDC (Microsoft Entra, Okta, Auth0, Keycloak, Google Workspace).
• Passkey / WebAuthn and TOTP multi-factor authentication.
• Role-based access control with a five-role hierarchy.
• Audit logging on sensitive actions.

Compliance

We're building toward SOC 2, and a formal audit is planned. BreachLens is built for regulated and self-hosted buyers; deployment on infrastructure you already accredit keeps your existing controls and boundary intact.

Responsible disclosure

If you believe you've found a security issue in BreachLens or this website, we want to hear from you. Email security@breachlens.app. Our machine-readable policy lives at /.well-known/security.txt. We welcome good-faith research and won't pursue action against researchers who follow this policy.