ISO 27001
Information Security Management
Certified against ISO/IEC 27001. Covers how information is classified, accessed, retained and destroyed, and how security incidents are detected and handled across the platform and the business behind it.
Security & Compliance
Assessing exposure without creating any.
See.Tech looks at your organisation the way the internet already does. That design choice is also its strongest security property: there is no agent on your estate, no credential held on your behalf, and no route from our platform into your network. This page sets out how the platform is built, certified, and operated — the detail procurement asks for before a pilot.
Certification
Independently certified, not self-declared.
See.Tech holds its own certifications. These are audits of See.Tech as an organisation — not an inherited claim about the cloud we happen to run on.
ISO 22301
Business Continuity Management
Certified against ISO 22301. Covers continuity of service and recovery objectives, so an assessment you depend on for reporting remains available when it matters.
Architecture
How the platform is built and hosted.
Microsoft Azure
Customer information is hosted in Microsoft Azure. Platform services run in hardened, access-controlled environments with change management and monitoring in place.
Encrypted in transit and at rest
All traffic is protected with TLS 1.2 or above. Stored data is encrypted at rest with AES-256.
Entra ID with MFA
Access is authenticated through Microsoft Entra ID with multi-factor authentication enforced for platform and administrative accounts.
Role-based access control
Permissions are granted by role, including inside the AI assistant — Ask AI cannot surface a finding to a user who is not entitled to see it.
No standing access to your estate
See.Tech requires no agent, no appliance, no VPN, no API keys into your tenancy, and no domain credentials. There is nothing for an attacker to compromise in order to reach you through us.
Scan authorisation on record
Full scans, vulnerability assessments, executive reports, and breached credential checks require an explicit authorisation acknowledgement, recorded with the username, timestamp, IP address, endpoint, and browser.
Data protection
Scope-limited by design.
See.Tech assesses information that is already public. We hold no data beyond what an assessment needs, and findings reference the regulatory obligations they bear on, so a report is usable as evidence rather than only as a technical artefact.
- Assessments are built from publicly reachable information — no internal data is collected.
- Nothing is retained beyond the scope of the scan that produced it.
- Findings and reports reference applicable obligations under POPIA, GDPR, and PCI-DSS.
- Breached credential checks report that an exposure exists and where it surfaced; they are not a credential store.
- Vulnerabilities are reported and scored, never exploited or proven by exploitation.
Procurement questions
The questions we get asked before a pilot.
Do you need credentials, an agent, or network access?
No, to all three. See.Tech is agentless and entirely external. A domain name is all that is required to begin an assessment. This is a deliberate constraint rather than a limitation — it is what allows an assessment to start in hours, and what makes assessing a third party possible at all.
Does See.Tech exploit the vulnerabilities it finds?
No. Findings are identified and scored on real-world severity using CVSS, but never exploited. Assessments are non-invasive and do not put production services at risk. If you need proof of exploitability, that is a penetration test, and our findings give one a well-evidenced starting point.
Does this replace our vulnerability management platform?
No, and it is not intended to. Agent-based and credentialed tools such as Qualys, Tenable, or Microsoft Defender Vulnerability Management assess hosts you already control and already know about. See.Tech assesses what the internet can reach, including the assets nobody registered. Most organisations run both, because neither sees what the other sees.
Are we allowed to scan a supplier or third party?
External assessment uses only publicly available information, which is what makes third-party and supply chain assessment practical. You remain responsible for ensuring you are authorised to assess a given domain, and every scan captures an authorisation acknowledgement against the user who ran it.
Where is our data held, and for how long?
In Microsoft Azure, encrypted in transit with TLS 1.2 or above and at rest with AES-256. Nothing is retained beyond the scope of the scan that produced it. See.Tech is certified against ISO 27001 for information security and ISO 22301 for business continuity.
How do we report a security issue in See.Tech itself?
Disclosure details are published at see.tech/.well-known/security.txt. We would rather hear about a problem from you than not hear about it at all.