The architecture, not the marketing.
EtherSight processes asset metadata for security buyers — that's a high-trust position. This page is the unvarnished detail: how data moves, where it lives, what's certified, and what's still on the roadmap.
Built on boring primitives.
No exotic crypto. No custom auth flows. Boring, well-understood building blocks, applied carefully and tested by an internal security audit (15 findings, all 15 closed at launch — full summary available on request below).
PostgreSQL Row-Level Security. Every table carries a tenantId column; RLS enforces at the database, not in application code. Cross-tenant access is rejected at the database layer rather than relying on application-level checks.AES-256-GCM at rest. Keys held outside the application code path, not in environment variables. Rotation is operator-driven and audit-logged.OIDC + PKCE for single sign-on. JWT with refresh-token replay detection. CSRF Double Submit Cookie pattern for mutations. Session fixation actively defended against.TLS 1.3 everywhere, HSTS preload, Traefik with Let's Encrypt wildcard certificates. Only port 443 exposed externally. Backups encrypted independently, off-cluster.Where your asset graph actually lives.
Default tenancy is the United Kingdom — UK cluster with PostgreSQL HA (Patroni), Redis Sentinel, OpenSearch. EU and US dedicated tenancy on the roadmap for Enterprise customers. Not vapour — scoped and prioritised.
What's earned, what's coming, and when.
Compliant means we have evidence we can produce on request. Aligned means we operate to the standard but haven't been audited against it yet. Planned means it's on a roadmap with a target window — no more, no less.
Who else touches your data.
Material changes to this list are notified 30 days in advance. Customers can object via written notice and we'll either grandfather or terminate, no fight.
No customer asset data passes through analytics, email or DNS providers. Data plane stays on the primary infrastructure provider only.
Everything your security team will ask for.
All the artefacts up front. Most don't need an NDA. If something isn't published, ask — we'd rather hand it over than make you negotiate for it.
Found something? We want to know.
Email security@ethersight.app with reproducer steps and we'll get back to you. We don't run a public bounty programme yet, but in-scope reports earn a public credit and (where appropriate) a meaningful thank-you. We won't go after good-faith researchers.
PGP key available on request from security@ethersight.app.
We don't bluff badges. You don't have to bluff approvals.
If your security or procurement team needs something we haven't published, ask. We'd rather hand it over than make you fight for it.