Scanning safety
Bounded public-surface execution
Public scanning is constrained to reduce abuse and prevent access to internal infrastructure.
- HTTP/HTTPS only with ports 80/443
- Private, loopback, link-local and reserved networks blocked
- Redirect targets revalidated
- Browser concurrency and free usage rate limited
- Scan execution time bounded
Evidence handling
Collect less by design
Network evidence is designed to support technical review without unnecessarily retaining sensitive request data.
- Query strings and fragments removed from stored request URLs
- Request and response bodies not collected
- Request and response headers not collected in network manifest
- Filesystem evidence paths not exposed through scan metadata
- Evidence responses marked private and no-store
Identity & access
Multi-tenant access model
The platform core supports organizations, workspaces and portfolio-level separation with role-based access.
- Owner, Admin, Compliance, Analyst, Developer and Viewer roles
- Session bearer tokens stored only as hashes
- Passwords stored using salted scrypt hashes
- Session expiry and revocation supported
- Workspace-level membership model prepared for enterprise scope
Operational design
Isolated service boundaries
Browser execution, webhook egress and secret-bearing application services run behind narrow internal boundaries.
- Browser worker has no Paddle or database credentials
- Webhook delivery uses an isolated HTTPS-only egress worker
- Runtime PostgreSQL role cannot perform schema DDL
- Systemd services use no-new-privileges and empty capability sets
- Plan-aware evidence retention is enforced by a scheduled worker
External service boundaries
Purpose-limited provider use
External providers are used for specific operational functions rather than broad access to scan evidence.
- Paddle processes subscription checkout as Merchant of Record; Lexsentra does not receive card details
- Resend processes recipient and message data for verification and alert emails
- Public scan targets receive ordinary browser or HTTP requests from the isolated scanner
- Network evidence excludes request/response bodies and headers
- Open and click tracking are disabled for Lexsentra transactional email
Customer control
Access and lifecycle controls
Workspace access and evidence lifecycle are explicit, reviewable parts of the product.
- Email ownership verification before active or costly actions
- Tenant-scoped roles and CSRF-protected state changes
- Separate expiring tokens for public evidence sharing
- Plan-specific evidence history and scheduled deletion
- Operator-assisted tenant-scoped read-only export for verified customer exit requests
- Email and HTTPS webhook alert destinations managed per workspace
Security claims stay evidence-based.
Lexsentra does not currently claim SOC 2, ISO 27001 or another third-party security certification. We provide an evidence-based review of implemented controls and clearly separate current capabilities from roadmap work.