Security and trust

We help you find weak points. Protecting yours comes first.

BreachForge holds a picture of where your defences are strong and where they are not. That is sensitive by its nature, so we treat it that way. Here is plainly how your data is protected, and what happens if something goes wrong.

Encrypted, always

Your data is encrypted in transit with modern TLS, and at rest on the platform. Backups are separately encrypted again before they leave the platform, so a copy is never readable on its own.

Your data is your data

Every account is isolated. One customer can never see another customer's estate, findings or results. Access is tied to a verified sign in, checked on every request, not just at login.

Backups we have actually restored

Backups are only real if they can be restored. Ours are tested by restoring them, not assumed. We keep encrypted copies on an independent schedule so a bad day does not become a lost estate.

Safety-first AI

Our assistant explains your result in plain English. It has no access to your database and no ability to act on your systems. What it can say is screened both on the way in and the way out.

What we do, in plain terms

No jargon. This is what protecting your data looks like day to day.

✓We never touch your live systems. BreachForge models your estate from what you tell it and the evidence you upload. It does not scan, probe or connect to your production network. There is nothing for us to break.
✓We store the model, not your secrets. When you upload a config export, we read the settings we need and keep those as facts. The raw file is not retained. We do not want your credentials and we do not keep them.
✓Sign in is handled by a specialist. Identity and passwords are managed by a dedicated authentication provider, not rolled by hand. Your session is a signed, short-lived, HTTP-only cookie that scripts on the page cannot read.
✓The browser is locked down. Strict transport security, clickjacking protection, content-type protection and a tight permissions policy are set on every page.
✓We run on hardened infrastructure. The platform is served from a global edge provider with DDoS protection and isolation built in. There is no server of ours sitting in a cupboard to be forgotten.

If something goes wrong

The honest question a security buyer asks is not "are you perfect", it is "what happens when you are not". Here is our answer.

✓We can recover. Encrypted, restore-tested backups mean an outage or a mistake is a recovery, not a loss.
✓We would tell you. If an incident affected your data, we would contact affected customers promptly and plainly, with what we know and what we are doing.
✓We keep records. Sensitive actions are logged so an incident can be understood and traced, without storing the content of your questions in the clear.
✓We keep improving. BreachForge is a security company. We run the same kind of assessment on ourselves that we sell, and we act on what it finds.

Need the detail?

Security teams and procurement often want more than a summary. We keep a fuller security overview for exactly that, covering our controls, data handling and assurance work in depth.

Read the full security overview Talk to us

BreachForge is a product of Cyber Spartans Ltd. This page describes our approach in general terms. For contractual security commitments, data processing terms or a completed security questionnaire, contact us and we will share the appropriate documentation under NDA where needed.