Security
Security is part of the product boundary.
NordTracer separates cloud management, customer-controlled internal scanning and external scanning. This page describes the public, verifiable security posture of the marketing site and product workflow without making unverified certification claims.
Deployment model
- Findings, workspaces and reports are managed through the NordTracer cloud console.
- Internal inventory and network scanning run through a customer-hosted NordTracer appliance.
- Internet-facing assets are assessed from dedicated external scanners.
- Role-based access controls support teams and multi-customer partner portfolios.
Marketing-site controls
The public site enforces a restrictive Content Security Policy, denies framing, limits browser permissions and loads Microsoft Clarity only after consent. Demo requests open the visitor’s email application; form values are not posted to the marketing-site server.
Responsible disclosure
If you believe you have found a security issue affecting NordTracer, email [email protected]. Include the affected URL or component, reproduction steps and potential impact. Do not access other users’ data, disrupt services or perform destructive testing.