Security & deployment

The picture a security or procurement reviewer needs: how the service runs, what data it uses, what it collects from you, and how to report a problem. ESIP's posture follows the same principle as its signals: verify, don't trust. Everything here is checkable.

This website is a static site served from Cloudflare's edge (Workers and Static Assets). It renders no customer data and holds no database. ESIP's signal data is served by a separate API: the free tier at public.exposuresignal.io and the commercial tier at api.exposuresignal.io.

Every signal is derived from publicly observable evidence: exploitation catalogs, prediction scores, exploit repositories, advisories, and patch sources. Producing a signal requires no access to your environment, your assets, or your scan data.

• Free surfaces publish observations only: dated, sourced events, the exposure class, and the ATT&CK mapping.
• The interpretive verdict is the commercial product, kept behind the API.
• No customer-specific data appears on any public surface.

• To issue a free API key or send the weekly digest, we collect the email address you submit, nothing more.
• Form submissions are protected by Cloudflare Turnstile to deter abuse.
• The free tier requires no payment details. Commercial payments are handled by Stripe; ESIP does not see or store card data.

• API access uses a per-account key sent in the X-API-Key header.
• Issuance secrets and credentials are held server-side only and never appear in this website's source.
• Site secrets are configured in the Cloudflare dashboard, not committed to the repository.

The services ESIP relies on to operate this site and its access flows:

• Cloudflare: hosting, edge delivery, and bot protection (Turnstile).
• Stripe: commercial payments.
• Resend: transactional email (key delivery and the digest).

Every signal is deterministic and evidence-backed: the same evidence under the same rules always produces the same verdict, and each one traces to the public source behind it. The method is defined in the published reference and explained on how it works.

Report security issues in the site or the API responsibly to security@exposuresignal.io. Disclosure details follow RFC 9116 at /.well-known/security.txt.

• The published reference →
• The data license →
• Why the signal layer can be relied on →