A security product.Built like one
Hosted in Sweden: the platform, the database and the backups run in Swedish data centres. You're trusting us with your most sensitive surface. This is how we treat it.
You're letting uslook inside
So here is exactly how PollySec protects what it sees.
Hosted in Sweden
The platform, the database and the backups run in Swedish data centres. AI verification and breach lookups use carefully chosen services outside Sweden, and e-mail addresses are removed before anything reaches the AI model.
Tenant isolation
Every tenant's data is kept apart by filters on every tenant-scoped query in the data layer, backed by automated tests, with access control for MSP hierarchies.
Encrypted
TLS in transit, authenticated sensor channels, and secrets encrypted at rest under keys wrapped in a separate key vault. Keys pushed to a sensor live in memory only: never on disk, never in logs.
AI kept off the sensors
Sensors never hold an AI key. All AI work is orchestrated by the platform, not on your network.
Scanning with precision
A profile of its own for industrial networks, not a single byte to a printer's raw print port, and scanning only inside the range you set.
Account protection
Account lockout and per-IP rate limiting on sign-in, against brute force and credential stuffing.
ARIA runsinside hard limits
ARIA tests findings against real systems. These are the rules it runs by.
Scope, checked twice
The sensor and the server both check that a tool only touches assets inside the finding's scope.
It speaks the protocol
Some tools speak the protocol, like an anonymous FTP or LDAP login attempt or an SMTP relay test that never sends mail. Every check is aimed at the finding it tests.
Targeted, not a flood
A run is a handful of targeted checks: at most 12 tool calls (16 for Critical, network-exposure, known-vulnerability and information-disclosure findings), a hard 30-second timeout per tool, and it stops by itself within 10 minutes.
OT refused
ARIA does not run on OT networks. Other internal networks get four checks: DNS, TLS, TLS versions and HTTP.
The sensor.Quiet by design
Dials out
It connects out to PollySec over an encrypted channel. You open no inbound port in your firewall for it.
Verified updates
Updates arrive over the same connection, are checked against a SHA-256 hash, and roll back automatically if the new version crash-loops.
Nothing written down
Configuration and keys pushed from PollySec live in memory, never on disk.
Stays in its lane
The sensor refuses any target outside the private networks you assigned to it, whatever it is asked to scan.
Found a bugin us?
Tell us first.
Report a vulnerability
Email our security team. Our security.txt lists the same address.
security@pollysec.comRetention
Deleted assets and findings are purged after 90 days by default. Credentials captured by a decoy are wiped after 7 days.
Questionnaire, or a specific control in mind? Ask us at security@pollysec.com.
Bring your hardest questions
Book a demo and bring your security team. Ask us to prove any of this.
Book a demo