Our own security posture
We sell data security. Here is how we handle yours — stated plainly, the same way our product explains its findings.
Data handling
We read the minimum metadata needed to evaluate posture and flows. Where content inspection is required (Flow Guard), content is processed transiently for classification and is not retained beyond the verdict and its evidence excerpt.
Findings, verdicts, and their evidence are stored encrypted at rest. You can export or delete your workspace data at any time — deletion is a product feature, not a support ticket.
OAuth-only scopes
Connectors authenticate with OAuth or vendor APIs using the narrowest scopes that support the engine you enabled. We list every scope we request and why, per connector, in the docs.
No endpoint agents, no network appliances, no browser extensions. Revoking the OAuth grant severs our access instantly — your kill switch is the identity provider you already control.
Platform security
You sign in with an email address and password, or with Google. Passwords must be at least 12 characters and are stored only as salted scrypt hashes — never in readable form — and sign-in attempts are rate-limited per IP address. Anyone can add a second factor (TOTP authenticator apps plus one-time backup codes), and an organization can require it for every member. Enterprise organizations can add single sign-on (SAML with Okta, Azure AD, Google or OneLogin), make SSO the only way in, and restrict access to trusted IP ranges (IPv4 and IPv6).
Every sign-in creates a session held in an HttpOnly, Secure cookie and backed by a server-side record that is checked on every request — so a session you revoke, or one that breaks your organization’s IP or session policy, ends immediately. You can review your active sessions and sign out of all of them at once. Inside the product, access is least-privilege: fine-grained custom RBAC built from per-feature permission atoms, session policies (maximum duration, idle timeout and force-logout), and an append-only per-organization audit log you can stream or export to your SIEM as CSV, JSON or CEF.
Every release ships behind a suite of more than 4,000 automated tests, translation-parity gates across 13 languages, and a production build gate — the same engineering rigor we expect of the systems we secure.
Three levels of action — and only one of them writes
Every organization starts with Detect & Alert: 8200.dev reads through read-only scopes, finds risky permissions, data flows and agent actions, and explains each one. Recommend & Guide is read-only too — it adds the exact fix and step-by-step instructions for a person on your side to apply. Anywhere the product shows what would be blocked without write access, it is labeled as a simulation; we never claim enforcement we do not have.
Auto-remediate is the only level that changes anything in your sources, and it is off by default. It acts only when an owner or admin has switched it on for the organization, a policy for the rule is armed, and you have separately granted that connector the write scopes it needs — a second consent you can revoke at any time without interrupting monitoring. Even then it only revokes or reduces access (for example, removing a public link or an external share); it never deletes files or touches their contents, and every action is written to the audit log. Auto-remediate is not available on Google Workspace yet: the write scope it needs has not been verified by Google.
No offensive capabilities
8200.dev contains no exploitation, lateral-movement, or offensive tooling of any kind. The platform observes configurations, evaluates data flows, and enforces policy through the vendor APIs you authorized — nothing else.
Audit logging
Every action the platform takes — every scan, finding, block, and configuration change — is written to an append-only audit log. Business and Enterprise tiers can export it.
Our own admin actions on your workspace are logged in the same trail and are visible to you. We don't have a quiet back door into your data, and we made sure you can verify that.
Reporting a vulnerability
Found something? Write to [email protected]. We aim to acknowledge reports within 48 hours, and we don't gag good-faith researchers.
We follow coordinated disclosure with a 90-day window: we work on a fix from the moment you report, keep you updated, and ask that you hold public disclosure for up to 90 days or until the fix ships, whichever comes first.