Legal & trust

Security practices.

How the platform is built, what we have verified — and what we have not yet certified. A security product earns trust with specifics, so here they are.

Infrastructure

Isolated honeypot hostsBaits run on dedicated machines, separate from the console and database.
One-way ingestionBaits can only push events out. They hold no production access and no credentials.
Minimal exposureSecurity groups allow only required ports; the database sits in a private subnet.
No SSH keysHost access via AWS SSM Session Manager only; IMDSv2 enforced.
WAF + rate limitingAWS managed rule sets plus per-endpoint request budgets in front of the API.
EU residencyEverything — compute, data, backups, email — in AWS Paris (eu-west-3).

Application security

  • Passwords: bcrypt, cost factor 12.
  • Two-factor authentication: TOTP, enforced for staff accounts.
  • Invites: one-time, 24-hour set-password links (sha256-hashed at rest). No temporary passwords in emails, ever.
  • API keys: sha256-hashed at rest, scoped (ingest / deploy), rotatable without downtime.
  • Field-level PII encryption: account emails and names are AES-256-GCM encrypted in the database; lookups go through an HMAC-SHA256 blind index. A database dump does not reveal who our users are.
  • SQL: parameterized queries everywhere — verified under active SQL injection testing.
  • Log hygiene: user emails are masked in application logs.

Tenant isolation & admin blindness

Every query in the console is scoped to your tenant — and this is not just a policy:

  • Superadmin blindness: platform administrators cannot list your users, read your captured data, or browse your baits. The staff console shows tenant metadata only (name, plan, seats).
  • No cross-tenant web actions: tenant lifecycle operations (create, delete user, set plan) run exclusively through an internal operations API that is only reachable inside the VPC, driven by an audited runbook.
  • Audit trail: every privileged platform action is written to an append-only audit log, visible to staff.
  • Pentest-verified: cross-tenant access attempts (IDOR) were actively tested and denied.

Independent verification

A full-spectrum internal pentest (recon → exploitation → post-exploitation) was run against the production platform in July 2026. Every finding was fixed the same day and re-tested. The detection pipeline was proven end-to-end: every simulated attack was captured, scored and surfaced.

The next step on the roadmap is an external, third-party pentest — we will publish the scope and remediation summary when it happens.

Email & domain

  • SPF, DKIM and DMARC are configured on silentbait.io.
  • Transactional email is sent via AWS SES from noreply@silentbait.io — we will never ask for a password by email.

Report a vulnerability

Email alachaud@silentbait.io with details and reproduction steps. You will get an acknowledgement within one business day, and a timeline for the fix. We ask that you give us reasonable time to remediate before public disclosure. We do not currently run a paid bug bounty program.

Compliance status — the honest version

SOC 2 and GDPR certification programs are on our roadmap. We are NOT yet certified, and we won't claim otherwise. No Data Processing Agreement template exists yet; if your compliance team needs one, contact us and we will tell you exactly where we stand and work through it with you.

What exists today is what this page lists: EU data residency, encryption in transit and at rest (including field-level PII encryption), pentest-verified tenant isolation, admin blindness, and an audited operations model. We would rather show you the real controls than hang a badge we haven't earned.

Last updated: August 3, 2026.