Skip to content

Architecture & data handling

This page answers the questions that matter when you trust a security vendor with your environment: what runs where, how your data is protected, and how your organization is kept isolated from every other tenant.

What runs where

  • On your infrastructure — only the scanner agent you install. It runs scans on the hosts you choose and reports results back over an encrypted, authenticated channel.
  • On the ScanNinja platform (hosted on Azure) — everything else: the service your dashboard and agents talk to, off-host scanning, finding enrichment, and storage of your findings and reports.

Data protection

  • Encryption in transit. All agent-to-platform and dashboard-to-platform traffic is encrypted with TLS.
  • Encryption at rest. Platform data is encrypted at rest, and scan credentials are held in a managed secrets vault — or referenced by pointer to a vault you control, so secrets never land in our database or logs.
  • Least-privilege scanning. Compliance scans are read-only; the agent can be configured so sensitive finding categories never leave your host — only a classification and a hash are reported.

Multi-tenant isolation

ScanNinja is multi-tenant. Every customer's data is logically isolated: a request scoped to one organization can never read another organization's data. Scanners authenticate with a per-organization credential that binds each agent to exactly one tenant, so there is no cross-tenant path for scans, credentials, or findings.

Where to read more