Overview & core concepts

What the platform is, the tier model, and how storage degrades gracefully.

Passwordless OTP sign-in, the limits that apply, and disposable-email handling.

Plans, prices & quotas

Every SKU and quota, read live from the platform catalog.

Every tool on the platform, grouped by category, listed live from the catalog.

Multi-tenant log ingestion, detection and AI triage — with API examples.

QR enrolment, the installable PWA, posture signals and fleet reporting.

Website monitoring & agent

Register a site you own, prove control of the domain, install the PHP agent, and watch events arrive.

Seats, invitations, and the Team Security Center.

Free modules, progress sync, AI tutor, and verified certificates.

Authentication, every endpoint, rate limits and status codes.

Security & privacy model

What is never stored, the defences in force, and how to report a vulnerability.

Quick reference (printable)

Every tool on one page: tier, what it takes, whether it uses AI, and whether it stores anything.

What each panel means: usage, quotas, pack balances and account state.

The problems users actually hit, and what to do about each.

How prepaid passes work, what expiry means, receipts, and where the binding terms live.

// tool reference · Vulnerability & Assessment

Account & Exposure Check Free + Pro

Check breached passwords/emails and domain spoofability.

Open Account & Exposure Check →

What it does

Checks whether an email address or password appears in known breach corpora. The password path is built so that your password never leaves the browser in a usable form.

When to use it

Onboarding, to check a reused password before it becomes your problem.
After a third-party breach, to see whether your domain appears.

Inputs

Field names are the actual form parameters, verified against source.

Field	Type	Required	Notes
email	email	optional	Address to check.
password	password	optional	Checked via k-anonymity — see method.
domain	text	optional	Domain-wide exposure.
authorized	checkbox	required	You confirm the address/domain is yours.
action	hidden	optional	Which check to run.

What you get back

Breach appearances with dates and what was exposed, plus what to do.

Worked example

Input

email = you@example.com   (authorized [x])

Output (abridged)

3 breaches contain this address

  2019  ServiceA   emails, password hashes (bcrypt)
  2021  ServiceB   emails, PLAINTEXT passwords   <- act on this one
  2023  ServiceC   emails only

Severity is about WHAT leaked, not how many. ServiceB exposed plaintext:
if that password was ever reused, treat every account sharing it as
compromised.

  -> Rotate anything reusing the ServiceB password.
  -> Enable MFA where reuse is likely.
  -> Email-only exposure = expect phishing, not takeover.

How it works

k-anonymity for passwords: the password is SHA-1 hashed locally and only the FIRST FIVE characters of that hash are sent. The range of matching hashes comes back and the comparison happens on our side of the wire — the remote service never sees enough to identify your password. Outbound requests go to fixed, hardcoded hosts.

Limits

Read live from the platform configuration.

Free	— check
Pro	— checks
Timeout	—s

Limitations — what it does not do

Absence of evidence only. A breach that was never disclosed, never indexed, or is still private will not appear. 'No results' means 'not in known corpora' -- never 'safe'.

Privacy

Passwords are never stored, never logged, and never transmitted whole.

Standards

NIST SP 800-63B (breached-password screening)

← All tools Manual home