Skip to content
ConfigProof

Security

Can I trust you with a firewall configuration?

A firewall configuration is one of the most sensitive files an organization owns. The answer here is a set of specific mechanisms, not a set of promises.

What happens to the file

The raw XML has the shortest life the product can give it.

  1. 01

    Upload

    A one-time signed upload into tenant-scoped ephemeral object storage. Size, file count, extension and time limits are enforced on the server, and a SHA-256 digest identifies duplicate snapshots.

  2. 02

    Parse

    DTD loading, external entity resolution and network access are disabled. Depth, element count, attribute size, text size and processing time are all bounded.

  3. 03

    Normalize

    Supported configuration becomes immutable structured entities and reference edges. Evidence records keep source paths and safe values, not the file.

  4. 04

    Delete

    The raw XML is deleted immediately after successful normalization, unless you explicitly enabled retention. The deletion timestamp is stored and shown to you.

  5. 05

    Failure path

    A failed upload may be kept for a bounded troubleshooting window of no more than 24 hours, then removed.

Isolation and encryption

  • TLS in transit, encryption at rest on storage and database.
  • Every query is scoped to one organization, and cross-tenant access is covered by tests rather than by convention.
  • Raw configuration access is a separate permission inside your organization. A viewer does not receive it implicitly.
  • Analysis runs as an asynchronous job on infrastructure that never receives your credentials, because the product never asks for them.

What never leaves the pipeline

Some values are removed before anything is written to a log, a trace, an error report or a support bundle.

  • Raw XML, in any log, trace, analytics event or email.
  • Password hashes, private keys, shared secrets and certificate material.
  • Internal addresses, rule names and client identifiers in generic telemetry.
  • The complete configuration sent repeatedly to a model. The model receives normalized facts for one finding at a time.

Names and descriptions inside a configuration are treated as untrusted input and as a possible prompt-injection vector, so they are never followed as instructions.

What our staff can see

Support access is a supervised, audited session, not a back door.

  • There is no normal path for platform staff to view or download raw XML. Admin and support tools do not expose it.
  • A support session requires a stated reason, step-up authentication and an expiry.
  • While a session is open, a banner shows the customer identity and the session mode, and every navigation and action is audited.
  • The session is read-only by default. An assisted edit mode may touch application data only after your explicit approval, and every write is attributed to the operator rather than to you.
  • You can revoke a session immediately.

Retention and deletion

Retention is a plan property, and deleting sooner is always available.

Retention and deletion
PlanAssessment retentionRaw XML
Free Preview24 hoursDeleted after normalization
Single Assessment60 daysDeleted after normalization
Engineer180 daysDeleted after normalization
Consultant1 yearDeleted after normalization
MSP2 yearsDeleted after normalization
EnterpriseCustomDeleted after normalization

You can delete an assessment, a client or the whole account at any time, and the deletion propagates to derived artifacts.

What the model is allowed to do

It receives

  • Findings that already exist, produced by deterministic code.
  • Normalized, redacted evidence values for the finding it is explaining.
  • The stable control definition and the module it belongs to.

It never receives

  • The raw configuration file.
  • Credentials, keys or certificate material.
  • Permission to create a finding, change a severity or name an entity that does not exist.

Model output is validated against a strict schema. Anything referencing an unknown ID, path or enum value is rejected, and the original machine result is stored separately from any human edit.

Responsible disclosure

If you believe you have found a vulnerability, tell us before you tell anyone else. We will acknowledge within two business days, keep you updated while we fix it, and credit you if you want to be credited.

In scope: the ConfigProof application, its API and its infrastructure. Out of scope: denial of service, social engineering, and reports generated only by an automated scanner with no demonstrated impact.

Report a vulnerability

About certifications

ConfigProof performs an evidence-backed technical review. It is not a compliance certification, and we do not display a certification, an audit report or a customer name that we do not have.