Saluki
Book a demo
Security & trust

Safe by design.

Saluki runs against production every day. These are the rules it runs by.

  • Rules of engagement, enforced: scope 3 domains, 2 ranges; window 22:00 to 06:00 UTC; pace Low; non-destructive on.
  • 22:27:30 UTC, pursuit: GET /admin · vpn-02 · 200 · evidence saved.
  • 22:27:31 UTC, pursuit: Reproduced 3 of 3 · no data changed.
  • 22:27:40 UTC, AK: Reviewed PR-0917 · verified.
  • 22:28:04 UTC, resolve: Routed PR-0917 · PLT-412 · #sec-platform.
  • 22:33:52 UTC, pursuit: refused, api.ashcombe-supply.example · outside scope, logged.

Rules of engagement

You define the scope, the testing windows and the pace. The platform enforces them on every action, and refuses anything outside them. Changes to scope are logged and take effect immediately.

  • Scope: brackwell.example, brackwell-cloud.example, harbourfleet.example, 203.0.113.0/24, 198.51.100.0/24. Window 22:00 to 06:00 UTC. Pace Low. Scope change by RS logged 24 Oct 18:02, effective immediately.

Non-destructive testing

Pursuit reads, compares and reproduces. It never changes a record, never runs a destructive payload, and rate-limits itself against your systems. Operators follow the same rules.

  • PR-0917 evidence: GET https://vpn-02.brackwell.example/admin, response 200. Reproduced 3 of 3. No data changed: read-only method, no writes.

Audit and evidence

Every action, automated or human, is logged with its evidence. You can show your auditors exactly what was tested, when, and how.

  • Audit record, 24 Oct 22:27:30 UTC: pursuit, GET /admin on vpn-02.brackwell.example, response 200, evidence saved, linked to PR-0917.
  • Scope check passed: vpn-02.brackwell.example is in 3 domains, 2 ranges.
  • Window check passed: 22:27 is inside 22:00 to 06:00 UTC.
  • Pace check passed: Low · 2 req/s.
  • Method check passed: GET · read-only.
  • Evidence hash sha256 9f2c41d7…e41a, retained 12 months.

Access and data

Single sign-on and role-based access control. Data encrypted in transit and at rest. Regional hosting options and configurable retention, so your evidence lives where you need it, for as long as you need it.

  • SSO: Okta, SAML, enforced. RBAC: Admin, Analyst, Viewer. API: 2 keys, read-only. Regional hosting: EU. Encryption in transit and at rest. Evidence retained 12 months.

Responsible disclosure

If you believe you have found a security issue in Saluki itself, we want to hear about it. Use the contact form and we will reply quickly and treat your report with care.

See it run against your estate.

Book a demo and we will map your surface live, then show you the first path that matters. Or start with a domain.

Talk to us about your security review