Trust & compliance
Built on permission, transparency and restraint
RemedSec AI is deliberately positioned as a safe exposure discovery and remediation-entry platform, not a penetration testing or offensive security tool.
Authorization-first, always
Nothing is assessed without confirmed ownership or explicit permission. Scope and authorization are captured before any check runs.
Safe & non-intrusive
Phase 1 is discovery only. We observe externally visible signals - we do not exploit, intrude, or attempt to bypass controls.
Honest reporting
We separate observed exposure from confirmed exploitability and never claim a system is exploitable without approved validation.
Careful evidence handling
Authorization evidence and findings are kept within approved, private channels and treated as confidential.
What we will and won't do
What we will do
- Discover exposure on owned or authorized assets
- Run non-intrusive public checks (TLS, headers, DNS, fingerprints)
- Explain risk in clear business language
- Provide a prioritised remediation roadmap
- Offer deeper assessment only as an approved, booked service
What we won't do
- Act as an unauthorized scanner
- Perform exploit validation or intrusion
- Run credential attacks or bypass tooling
- Enable authenticated scanning by default
- Claim confirmed exploitability without approval
Responsible by default
Deeper, logged-in assessment, source-code review and container analysis are powerful and require explicit later approval. They are never part of the self-serve experience. This keeps RemedSec AI safe to adopt, easy to authorize, and aligned with the expectations of risk and compliance teams.
All working materials remain within approved private channels, and confidential product information is never shared with unmanaged external systems.
Authorization lifecycle
Trust is part of the workflow, not an afterthought
- 1
Client or authorised contact submits the target and purpose of assessment.
- 2
Scope and ownership or permission are checked before discovery begins.
- 3
Only non-intrusive public checks are run during the initial phase.
- 4
Findings are reviewed and framed with transparent confidence boundaries.
Evidence boundaries
Minimal evidence collection
The product keeps enough proof to explain findings and authorization, without encouraging unnecessary collection of sensitive material.
Private handling by default
Reports, screenshots, and approval records stay in approved private channels tied to the client engagement.
See what your public-facing systems are exposing
Register an owned or authorized website, confirm scope, and get a business-readable exposure report. No intrusion, no exploitation - discovery only.