The platform

A system holding several clients’ attack surfaces is itself a target

A penetration test report is a targeting package: unpatched hosts, exact versions, open ports, exploit paths. A platform holding a few of them at once is worth more to an attacker than any single estate in it. That fact drives the architecture rather than a hardening checklist at the end of it.

Talk to us The standard

Four properties

Isolation, encryption, audit, residency

Each of these is a property of how the software is built rather than a setting an administrator is trusted to find.

Tenancy

Isolation is a property of the data layer, not a rule that route handlers are trusted to follow. No repository method is callable without an organisation scope, so a new endpoint cannot accidentally be the one that leaks.

Cross-organisation read, list, search and download are all denied
A denial answers “not found” rather than “forbidden”, so existence does not leak
Roles that match how a firm works: owner, lead, analyst, read-only
A client role scoped to one engagement and provably nothing else
Multi-factor authentication that no role able to read a finding can skip

Encryption and access

Scan artifacts and evidence are the most sensitive objects in the system, and they are treated as such at rest and in every path that reaches them.

Per-organisation keys, rather than one bucket key for every customer
Objects reached only through short-lived signed URLs, never a readable path
No model credential ever compiled into the browser bundle — client-side keys are the most common leak in this category
Redaction before logging: no host, address, credential or payload reaches log storage

Audit and retention

Who saw a client’s attack surface, and when it stopped existing, are both questions with recorded answers.

An audit event on every read and every export, with actor, address and timestamp
Version history on reports, so the draft a client saw is still the draft they saw
Retention policies for scans and reports, applied by a sweep rather than by memory
Expiry deletes the stored object as well as the database row

Residency

Where inference happens is a deployment decision here, not a routing decision made by whichever provider is cheapest this quarter.

Model inference deployed per jurisdiction
If data cannot leave a region, the model comes to the region
Scan artifacts stored in the region the engagement belongs to
A residency commitment that does not depend on a vendor’s routing table

Hostile input

The file you upload was written by whatever was on the network

Scan output is attacker-controlled text. It is parsed on the server and rendered in the console, and neither side is allowed to assume it is well behaved.

XML external entity resolution disabled in every parser, and tested rather than assumed.
Finding titles and descriptions rendered inert everywhere they appear, including in exports.
Any URL appearing in scan data treated as a request-forgery vector before anything fetches it.
Uploads bounded and checksummed, so a malformed or oversized file is rejected at the edge rather than after it is read into memory.

Assurance

The checks that run against this platform

The authorization matrix, exercised programmatically
Every role against every resource against every action, run as a test rather than reviewed from memory. A gap in that matrix is a build failure.
An external penetration test
Commissioned rather than self-assessed, with high and critical findings resolved rather than accepted — and dogfooded through this platform, which is also the sharpest product test available.
Dependency scanning that blocks the build
A vulnerability-reporting tool shipping known-vulnerable dependencies is not a defensible position, so the scan is a gate rather than a report somebody reads later.
Correlated, redacted observability
A job id alone reconstructs a full lifecycle from the logs, and those logs contain no hosts, addresses or credentials to reconstruct it with.

Proof is an artifact, not a checkmark

Nothing here counts as working because a test went green. It counts when it produces something a person can open: a job id, a rejected row carrying a reason, a finding traced to the scan line that produced it, a cross-tenant request that came back empty, an export that carries the right watermark. Anything short of that is a claim about the software rather than a demonstration of it.

Run your procurement questions at it

Security buyers ask harder questions than anybody else, which makes them the most useful people to hear from. If something here would not survive your own review, say which part.

Talk to us For consultancies

Get in touch

Talk to the people building it

No chatbot and no ticket queue. Tell us what your security reporting actually looks like — which tools you live in, how long a deliverable takes, what a client has sent back — and someone who works on the software will reply.

info@legosphere.com