Question 1

I'm not technical. Will I understand the report?

Accepted Answer

Yes. Every finding is written in plain English: what's wrong, what the consequence is for your business, how to fix it. Each finding also names who does the fix (your web host, your developer, your DNS administrator) and roughly how long it should take. The technical detail is one click away if your developer wants it, you do not need to read any of it to act on the report. If a finding does not make sense within a minute of reading it, that is our editorial bug, not yours. Email help@vantyris.com and we will rewrite it.

Question 2

What is Vantyris?

Accepted Answer

Vantyris checks your business website the way an attacker would, then tells you in plain English what's wrong and how to fix it. You point it at a website or domain you own, you get a report you can hand to whoever maintains your site. It is not a penetration test and not a compliance certificate. It is the security health-check most small businesses don't have the time, or the security person, to do themselves.

Question 3

What does a Vantyris scan actually look at?

Accepted Answer

Four questions today: (1) Is your padlock real, the privacy of the connection between your visitor and your site. (2) Is your visitor's browser being told what to do, whether your site sends the standard browser-protection instructions. (3) Can a stranger send email pretending to be you, whether your domain blocks email impersonation. (4) Can someone hijack your domain name, whether the basic DNS controls are in place. Three more questions are on the roadmap (anything reachable on your server that shouldn't be, known plugin / CMS issues with public exploits, and a broader hygiene baseline) and switch on as our infrastructure scales up.

Question 4

How does a Vantyris scan work?

Accepted Answer

Two speeds. The free teaser reads only what's already publicly visible to anyone on the internet, no ownership check, partial answer in seconds. Treat it as a sample. The verified scan (1 credit) runs after you prove the site is yours (a one-time DNS record, file upload, or HTML meta tag, your pick) and adds the checks that need your authorisation under UK law. First answer in under a minute.

Question 5

Is this a penetration test?

Accepted Answer

No. A pentest is a human attacker with creativity who looks for unique paths into a specific system. Vantyris is automated hygiene scanning, it checks the same broad set of things on every target. If a pentest is required (by regulation or by a client), book one. Vantyris is what you run before and between pentests.

Question 6

Can I monitor a site on a schedule, instead of re-scanning manually?

Accepted Answer

Yes. Enrol any verified target in continuous monitoring at a daily, weekly, biweekly, or monthly cadence from the target's page. Vantyris re-runs the scan on that cadence and alerts you by email only on the three things that matter: a new high or critical finding, a security-score drop of ten points or more compared to the previous scan, or a TLS certificate within fourteen days of expiry. No daily noise. The notify-email defaults to the workspace owner; you can override it per target (for example, to your web host).

Question 7

Can I show a customer or insurer my current security posture without giving them an account?

Accepted Answer

Two ways. A time-limited share link with an optional watermark, in full, executive, or evidence-redacted mode, viewable for 1 to 90 days, revocable any time. Or a public trust page at a slug you choose, with toggles for which sections show (current grade, last-scan date, controls-in-place checklist). The trust page is off by default and stays off until you enable it. Insurers asking for evidence of an external scan in the last 12 months can read it directly; you don't need to forward a PDF.

Question 8

Does this map to Cyber Essentials?

Accepted Answer

Vantyris is not a Cyber Essentials certifying body. Every verified scan report includes a Cyber Essentials alignment section that maps each finding to the five NCSC control areas (firewalls, secure configuration, security update management, user access control, malware protection) and shows you which controls an external scan can speak to versus which need internal evidence (endpoint posture, policy). It's the kind of section that turns into a starting checklist for a CE submission.

Question 9

Can I script Vantyris from my CI pipeline or SOC dashboard?

Accepted Answer

Yes. Create a workspace API key from Settings → API keys. Read-only or read-write scope, plaintext shown once at creation, revocable any time. Two endpoints today: list targets and list findings (filterable by severity, by workflow status, by target). Bearer-token auth. Two lines of curl. Full docs on the API-keys page itself. Each workspace can have up to ten active keys at a time.

Question 10

What's the difference between a teaser and a verified scan in plain English?

Accepted Answer

A teaser reads only what's already public about your site, two modules (transport security, browser-protection headers). It's a quality sample of the report; no ownership check, no signup, partial answer in seconds. A verified scan adds two more modules (DNS hygiene, email impersonation) plus all the workspace features: triage workflow, score trend over time, attack-surface discovery via Certificate Transparency, continuous monitoring, share links, PDF in three layouts. The verified scan costs one credit; the teaser is free.

Question 11

How many categories does the scan actually cover?

Accepted Answer

Nine: TLS & HTTPS, web hygiene, domain & DNS, email security, exposure, technology, reputation, supply chain, privacy. Each category gets its own score, grade, and severity counts on the report. The report is honest about which categories were assessed and which were not (some categories run only in the worker pipeline; if your scan didn't reach them, the category shows 'not assessed' rather than a false zero).

Question 12

What's the Fix Roadmap?

Accepted Answer

Every issue-bearing finding from your verified scan is sorted into a three-bucket roadmap: today (5-10 minutes or 30-minute fixes you do in your hosting panel), this week (1-2 hours or developer-day fixes that need coordination), later (fixes scheduled by lifecycle, like waiting for a cert renewal). Within each bucket, findings are grouped by owner (web host, developer, DNS admin, domain registrar, email provider, site owner) so one person picks up 'everything I need to do' without scrolling past anyone else's work. Severity always wins: Critical and High findings land in today regardless of effort.

Question 13

What does the Reputation category check?

Accepted Answer

Two surfaces. (1) Google Safe Browsing v4: we check the homepage URL against Google's malware, phishing, and unwanted-software lists. (2) DNS-based RBLs (real-time blocklists): we query Spamhaus ZEN + DBL, Barracuda Reputation Block List, SpamCop, SURBL, and URIBL against your resolved IP and apex domain. Useful because even if your site is clean today, an old subdomain that got compromised once can sit on a blocklist for months and quietly send your email to spam folders.

Question 14

What's the Attack Surface section of the report?

Accepted Answer

The first thing a regulator or insurer asks: 'what does the internet see when it looks at this domain?' We answer it with a structured section covering IPv4 and IPv6 addresses, nameservers and their provider hint (Cloudflare, AWS Route53, etc.), MX hosts that receive your email, DNSSEC validation state, CAA issuers, registrar and lock state, domain age, and subdomains discovered through Certificate Transparency logs. Built server-side from the structured data the scanner persists, not from parsing evidence strings.

Question 15

What's the difference between the typed owner / effort and the older free-text 'who does this' field?

Accepted Answer

Older Vantyris findings had a free-text 'who does this' line, which was useful but unmachineable. New findings carry both: the same plain-English label PLUS a typed enum (web_host, web_developer, dns_admin, domain_registrar, email_provider, site_owner) and a typed effort (minutes, thirty_min, two_hours, developer_day, renewal). The Fix Roadmap and the API use the typed fields so you can filter and group programmatically. The plain-English labels still render in the report exactly as before.

Question 16

Does the scan check for trackers and consent banners?

Accepted Answer

Yes, that's the Privacy category. We detect trackers loaded before consent, the presence (or absence) of a cookie banner, the presence of a privacy-notice link, and the IAB TCF consent signal. We don't issue a UK-GDPR or ePrivacy compliance judgement; we surface the lightweight surface a regulator or savvy visitor would notice first. If you want a full data-protection audit, that's a different kind of project; Vantyris tells you whether the obvious red flags are visible from outside.

Question 17

How many PDF layouts are there now?

Accepted Answer

Four, all generated server-side from the same scan: (1) Full editorial — the complete report with every finding, gauge, radar, scope, methodology, and audit-trail footer. (2) Executive summary — single page, top findings + grade, for a board pack. (3) Single-issue work order — one finding fully detailed, designed to forward directly to whoever does the fix. (4) Compliance report — sized and shaped for an auditor or insurer with the Cyber Essentials alignment grid front and centre. One scan, four PDFs.

Question 18

How does pricing work?

Accepted Answer

You buy a pack of credits. One credit = one verified standard scan of one target. Packs start at €10 for 5 scans. Credits are valid for 12 months. There is no subscription required, buy when you need, scan when you want.

Question 19

Do I need a subscription?

Accepted Answer

No. The Shield Plan exists as an optional convenience that gives you 10 monthly scans and a few perks, but every Vantyris feature is available without a subscription. Credit packs are the primary product.

Question 20

What payment methods do you accept?

Accepted Answer

Major credit and debit cards via Stripe. We support payment in EUR, GBP, and USD. We do not auto-convert: each currency has a native price set in advance.

Question 21

Can I use a promo code?

Accepted Answer

Yes. There's a promo-code field on the checkout page. One promo applies per order, codes don't stack. If a code is invalid or expired, the checkout will tell you immediately.

Question 22

How do refunds work?

Accepted Answer

Unused credits are refundable within 14 days of purchase. Email refunds@vantyris.com or use the contact form. Refunds are processed within 5–10 business days. Used credits aren't refundable. The full refund policy is at /legal/refunds.

Question 23

How do I get my report?

Accepted Answer

The report appears in your Vantyris workspace within seconds of the scan completing. You'll also receive an email confirmation. The report renders the same in the workspace as in the downloadable PDF, so you can forward the PDF to your developer or your accountant and they'll see exactly what you see.

Question 24

How quickly do I get a report?

Accepted Answer

A teaser scan returns a partial grade in seconds. A verified standard scan returns a first report quickly, most complete in under 90 seconds, then enriches with deeper checks asynchronously. You'll know the moment the first answer arrives.

Question 25

What format is the report in?

Accepted Answer

Two formats with identical content. A web view in the Vantyris workspace (interactive, filter by severity, click into evidence) and a PDF download (clean, paper-cream layout, suitable to forward to your web host, accountant, or insurer).

Question 26

Is my data secure?

Accepted Answer

Yes. Data is stored in EU-region Supabase with encryption at rest and in transit. Reports use signed URLs. Service keys never reach the browser. We apply to Vantyris itself the same checks we apply to your sites, see /methodology for the full account.

Question 27

What is your privacy policy?

Accepted Answer

Read it at /legal/privacy. Short version: we collect only what's needed to run the product (contact, billing, scan history), we operate under UK-GDPR + EU-GDPR, we retain scan PDFs for 12 months and raw artefacts for 30–90 days, you can request export or deletion at any time.

Question 28

Do you share my data with third parties?

Accepted Answer

Only with the processors we need to run the product (Stripe for payments, Supabase for storage, the email-sending provider, and Google Analytics if you've explicitly accepted the cookie banner). We never sell or rent your data. The full list of processors and what each one sees is in /legal/privacy.

Question 29

Do you use cookies or analytics?

Accepted Answer

Only with your explicit consent. On your first visit, a banner asks whether you accept Google Analytics. If you click 'Reject' or close the banner without choosing, gtag.js is never loaded and no analytics cookies are set. If you click 'Accept', we load GA4 configured with IP anonymisation enabled, Google Signals disabled, and ad personalisation disabled. You can change your mind any time via the 'Cookies' link in the footer.

Question 30

Where is my data stored?

Accepted Answer

EU-region Supabase (database, authentication, file storage) hosted in AWS Frankfurt. Static assets and report PDFs in Supabase Storage with signed-URL access. Backups encrypted, retained in the same EU region. Personal data does not transfer outside the UK / EEA except where required for transactional email delivery, where our email provider operates under Standard Contractual Clauses.

Question 31

How long do you keep my scan reports?

Accepted Answer

PDF reports: 12 months from generation. Raw scanner artefacts (intermediate output): 30–90 days. Account data: as long as your account is active, plus 90 days after deletion for account revival. Audit logs: 12 months. Billing records: the minimum period required by UK tax law (currently six years).

Question 32

Can I export everything Vantyris knows about me?

Accepted Answer

Yes. Settings → Your data → Export. We send you a JSON copy of your account, your targets, your scans, your findings, your workflow history, your share links, your monitoring enrollments. UK-GDPR Article 20 right to data portability.

Question 33

How do I delete my account?

Accepted Answer

Settings → Your data → Delete account. Account data is removed from the live system within 24 hours, from backups within 90 days. UK-GDPR Article 17 right to erasure. Anything we are required by UK tax law to retain (billing records) stays for six years from the last transaction.

Question 34

Is it legal for me to scan my own website?

Accepted Answer

Yes, Vantyris only runs scans against targets where you've proven ownership through DNS, a file you place on your site, or a meta tag. That verification step is the legal foundation of the service. Until you verify, only the harmless passive teaser is available.

Question 35

Can I scan a client's website?

Accepted Answer

Yes, but only with written authorisation from the client. Our Acceptable Use Policy (/legal/acceptable-use) requires you to certify you have permission. If you're an agency, we recommend keeping a signed authorisation letter from each client on file.

Question 36

What if I scan a website I don't own without permission?

Accepted Answer

The verification gate is designed to make that impossible. Active scans only run against verified targets. The teaser scan is the only thing that runs without verification, and it's deliberately passive, it does not interact with the target system.

Question 37

Will a Vantyris scan trigger my firewall or WAF?

Accepted Answer

Almost never. We're a single source IP making a small number of polite requests per minute, with a recognisable User-Agent (Vantyris/1.0) and full reverse DNS pointing back at vantyris.com. If you want to allowlist us, we publish our source IPs at vantyris.com/.well-known/scanner-ips. Most firewalls and WAFs see Vantyris and ignore it.

Question 38

Is Vantyris allowed in the UK / EU under GDPR?

Accepted Answer

Yes. Vantyris scans public-internet attack surfaces only, never inside a network. The data we collect is technical scan output (TLS, headers, DNS, email auth) plus your account information. No personal data of your visitors flows through us. We are UK-GDPR + EU-GDPR aligned and our processor list is on /legal/privacy.

Question 39

How do I assign a finding to my IT contractor?

Accepted Answer

On any finding card, click the status pill → 'Assigned' → enter your contractor's email and (optionally) a due date. Vantyris records the assignment in the append-only audit history. You can also post comments back-and-forth on the finding to keep the conversation in one place rather than chasing email threads.

Question 40

What happens when I mark a finding 'Accepted as known risk'?

Accepted Answer

You enter a written reason (required). The finding stays visible in the report but flagged as accepted. The suppression auto-expires after 90 days so it's not silently forgotten; you'll see it again on the next scan if it's still present, with the chance to re-accept it. Every status change writes a row to the audit-history table with the user who made it, the timestamp, and the reason. That's the evidence an auditor reads when they ask 'when did you decide this was acceptable, and why?'

Question 41

Can I monitor a site on a schedule, instead of re-scanning manually?

Accepted Answer

Yes. Enrol any verified target in continuous monitoring at a daily, weekly, biweekly, or monthly cadence from the target's page. Vantyris re-runs the scan on that cadence and alerts you by email only on the three things that matter: a new high or critical finding, a security-score drop of ten points or more compared to the previous scan, or a TLS certificate within fourteen days of expiry. No daily noise. The notify-email defaults to the workspace owner; you can override it per target (for example, to your web host).

Question 42

Can I show a customer or insurer my current security posture without giving them an account?

Accepted Answer

Two ways. A time-limited share link with an optional watermark, in full, executive, or evidence-redacted mode, viewable for 1 to 90 days, revocable any time. Or a public trust page at a slug you choose, with toggles for which sections show (current grade, last-scan date, controls-in-place checklist). The trust page is off by default and stays off until you enable it. Insurers asking for evidence of an external scan in the last 12 months can read it directly; you don't need to forward a PDF.

Question 43

What does the share-link watermark do?

Accepted Answer

It's an optional text overlay rendered as a band at the top and bottom of the shared report. Use it for confidentiality ('Confidential — for J. Smith, ACME Insurance') or to make screenshots traceable. View count is visible to you so you can see whether the recipient actually opened the link.

Question 44

Does the trust page show specific vulnerabilities?

Accepted Answer

No. The trust page shows current security grade (A+ to F), last-scan date, and a list of controls Vantyris has verified as healthy (e.g., 'HSTS in place', 'DMARC enforcing', 'CAA records pin certificate issuance'). It does NOT list open findings. The point is to show third parties that you're scanning regularly and what's known-good, not to publish what's broken.

Question 45

Can I take my trust page offline temporarily?

Accepted Answer

Yes. Settings → Trust page → uncheck 'Make this trust page publicly visible'. The page stops serving immediately. Your settings are preserved; flip the toggle back on whenever you're ready. The slug is reserved either way.

Question 46

Does Vantyris stop monitoring if my credit balance hits zero?

Accepted Answer

Yes. Continuous-monitoring scans cost one credit each, charged when the scan starts. If your balance is too low, the scheduled scan is skipped and you receive a low-balance email so you can top up. The next eligible scan happens when credits are restored.

Question 47

Can I get the same scan as three different PDF layouts?

Accepted Answer

Yes. Every verified scan can be downloaded as a full editorial report (paper-cream, fully detailed, for the file), a single-page executive summary (top findings + grade, for a board pack), or a single-issue work order (one finding fully detailed, designed to forward to whoever does the fix). Same data, three layouts, one click each. The audit-trail footer with the scan ID and methodology version appears on all three.

Question 48

Can I export findings to a CSV?

Accepted Answer

Two CSV exports. Per-scan: every finding on the current scan with rule_id, severity, business impact, fix, ownership, time-to-fix, workflow status, confidence, KEV listing, CVE IDs, priority score. Workspace-wide: every finding across every scan in the workspace, with either 'latest scan per target' or 'full history' modes. RFC-4180-compliant with a UTF-8 BOM, opens cleanly in Excel.

Question 49

Can my SOC dashboard or CI pipeline read findings programmatically?

Accepted Answer

Yes. Create a workspace API key from Settings → API keys. Two endpoints today: GET /api/v1/targets (list targets), GET /api/v1/findings (list findings, filterable by severity, target, workflow status). Bearer-token auth, JSON responses, paginated. Full docs and curl examples on the API-keys settings page. Each workspace can have up to ten active keys at a time.

Question 50

What's the API rate limit?

Accepted Answer

Soft: 60 requests per minute per workspace. Hard: 1,000 requests per day per workspace. Both are well above what a polite SOC dashboard needs. Exceed them and we return HTTP 429 with a Retry-After header. Email us if you have a legitimate use case requiring more.

Question 51

Does Vantyris integrate with Slack, Microsoft Teams, or Jira?

Accepted Answer

Not natively yet. The workspace API + your existing CI / automation layer (Make, n8n, Zapier) gives you the integration in two of those tools' steps: poll /api/v1/findings, post to your channel of choice. A native Slack/Teams integration is on the roadmap; the priority depends on customer demand.

Question 52

Can I white-label the PDFs and trust page with my own brand?

Accepted Answer

Pro and Agency tiers, yes. Settings → Branding lets you set a display name (replaces 'Vantyris' on shared reports + trust page), a logo URL (https-only, SVG preferred), and an accent colour. Standard tier saves the settings but doesn't apply them until you upgrade. Useful for agencies handing reports to clients in their own brand, or accountants embedding the trust page on a firm subdomain.

Question 53

Does my workspace have a portfolio view if I scan multiple sites?

Accepted Answer

Yes. /app/portfolio shows every target ranked worst-first (critical and high count first, then average score), plus workspace-wide stats (target count, average score, total criticals / highs / mediums). A 'Scan all' button kicks off a verified scan for every verified target your credit balance can pay for. Two CSV exports cover the workspace: latest scan per target, or full scan history.

Question 54

How does priority sorting work versus severity sorting?

Accepted Answer

Severity is the standard ordering (critical → high → medium → low). Priority is a composite score from 0 to 100 blending the severity, whether the underlying CVE (if any) is in the CISA Known Exploited Vulnerabilities catalogue (+15 if listed), and the history state (regressed +10, recurring +5). A finding that was new last month and got worse this month sorts above a finding of the same severity that just appeared. Toggle from the findings list toolbar.

Question 55

Does Vantyris produce a Cyber Essentials certificate?

Accepted Answer

No. Vantyris is not a CE certifying body. Every verified report DOES include a Cyber Essentials alignment section that maps each finding to the five NCSC control areas (firewalls, secure configuration, security update management, user access control, malware protection) and tells you which controls an external scan can speak to versus which need internal evidence (endpoint posture, policy). That's the starting checklist for a CE submission; the certification itself is a separate process with a registered CE body.

Frequently asked questions

Product

Billing

Delivery

Data & Security

Legality & Safety

Workflow & Sharing

Reports, PDFs, and Integrations