QFinch separates public, authenticated and administrative surfaces; scopes data and operations to organisations; applies policy before eligible scans; and retains provenance for reports and evidence.
Trust principles
- Explicit authorization for active assessment.
- Least-privilege provider integrations.
- Redaction and bounded retention for sensitive evidence.
- Isolated scanner execution and capacity controls.
- Versioned reports, artifacts and quality status.
- Transparent limitations and failed/incomplete states.
Detailed infrastructure and defensive configuration are not published. Security documentation is reviewed as the deployed architecture changes.
CTA: Contact the security team