Secure your code, cloud, and attack surface — in one platform

Pricing is per target bundle, so this matters before anything else. A target is a domain or an IP you add to monitoring, or a repository for code scanners. Any subdomain (as a web application) is a separate target. Regarding code scanning: one repo - one target. Without any pitfalls. Rescans are unlimited, users are unlimited, and read-only seats for auditors are free.

You can, and we run them too — the engine isn't the product. Running a scanner is a Tuesday afternoon. Knowing that a new staging.admin appeared last week, that a certificate expired 41 days ago, and that a host you'd forgotten was quietly answering the whole time — that's a system, not a scan. Topscan keeps the inventory, watches it continuously, tracks what you accepted versus fixed, and holds the evidence an auditor asks for.

No for external scanning — you add a domain or IP and it starts. SAST connects to your repository, CI/CD gating goes through a webhooks, and AWS misconfiguration checks use a read-only role. Nothing runs on your servers.

A pentest is a deep look on one day. This is a shallow look every day. A pentest tells you how far someone could get; continuous monitoring tells you what changed since Friday. Most incidents start with something that appeared after the last release.

That's what most teams use it for. Auditors ask for evidence of regular scanning and an inventory of what's exposed — both are produced automatically, and auditor seats are free and read-only.

Every finding ships with the evidence that produced it — hostname, status code, response banner, certificate date — so you can verify it in a second. Mark it as a false positive or snooze if you would like to postpone it, and it stops resurfacing. We'd rather report less and be checkable than report more.

You authorise scanning when you add a target and confirm ownership. Default discovery uses public registries, DNS and a single ordinary HTTP request. Port scanning and active vulnerability templates run only on targets you've explicitly confirmed — that boundary is deliberate, because in some jurisdictions an unauthorised port scan is a criminal matter.

Customer data is stored in the Hetzner cloud in Ashburn, Virginia, US. None of the developers have access to the production environment; only the Head of DevOps has access, and all his actions are logged. No customer data leaves our infrastructure or is transmitted to third-party systems (such as 3rd party AI services); all operations take place within a closed environment.
We are currently undergoing a SOC 2 audit and monitoring our processes via Drata.
In the event of account deletion, all data will be permanently removed from our servers within 180 days.