Trust Center
What Norveth actually does to keep accounts and scan data safe — no certifications claimed that haven't been earned.
Where this stands today
Norveth is an independently operated, pre-launch platform. It has not undergone a third-party compliance audit (SOC 2 or otherwise) — anything claiming otherwise on an older version of this page was wrong and has been corrected.
Account security
Passwords are hashed with bcrypt at cost factor 12. Email addresses are OTP-verified before password login is enabled. Sessions can be revoked, and Cloudflare Turnstile guards signup and login against bots.
Application security
Every outbound fetch the analyzer makes — while crawling a target site — is validated against an SSRF blocklist. The platform ships a full set of security response headers and enforces per-plan rate limits and quotas.
Infrastructure
Data is stored in PostgreSQL, served from Vercel, cached at Upstash, and sits behind Cloudflare. All traffic runs over TLS.