VesperID
Assess my exposure

About

A French cybersecurity company

VesperID was founded in Paris in 2024 to answer a simple question: what is circulating about your organisation right now, and what should you do about it? We answer to French law.

Request an exposure assessment Read our method
Exposure map Fictional data

In one sentence

VesperID is a French cybersecurity company specialising in threat exposure management: it continuously monitors what circulates about an organisation and its executives, compromised credentials, infected devices, impersonated domains, cybercriminal mentions; its platform scores every signal and delivers it with the expected action, and its analysts handle investigations, takedowns and reports.

Where this comes from

VesperID was born from a pattern seen again and again in incident response: in most cases, the information that would have prevented the crisis already existed somewhere, published weeks earlier, but nobody whose job it was had looked at it.

The market offered two answers. Very complete platforms, designed for full-time intelligence teams, and automated alerting services that sent everything, all the time, qualifying nothing. In between, organisations with neither thirty analysts nor an appetite for sorting noise were left unserved.

We built VesperID for that space: a platform that absorbs the volume, analysts who settle the hard cases, and reporting that fits on one screen rather than in a spreadsheet. The company is established in Paris and works with French and European organisations as well as with exposed individuals.

Our mission

Reduce the delay between the moment information about you becomes usable by a third party and the moment you learn of it. That delay is the only parameter external monitoring genuinely acts on, and it is often what decides how large an incident becomes.

Key facts

Values, units and dates, verifiable in the product or in the legal texts. Nothing estimated.

Company
French cybersecurity company, founded in Paris in 2024
Catalogue
15 services in 6 families
Platform
Built and operated in-house, isolated per client
Secrets retained
None: no password, no cookie, no full card number; metadata only
Exposure score
0 to 100, 90-day trend
Exposure chains
Recomputed every 15 minutes, 12 nodes at most
Playbooks
14, one expected action per case
Target handling times
4 hours to 90 days by severity, adjustable; the contractual commitments are in the terms
Secret reveal
On demand, logged, 20 per person per day
Reply to a request
Within one working day, public holidays excepted
Pricing
Bespoke, no public price, annual licence
Applications
Desktop (Windows, macOS, Linux) and mobile (iPhone, iPad, Android)

What you can verify

Trust is not declared. Here are the facts any reader can check, and where to check them.

  1. French cybersecurity company

    VesperID SAS is a company incorporated under French law, established in Paris. Its identifiers and its legal representative appear in our legal notice.

  2. Per-client isolation

    One isolated space per organisation, enforced in the database; encryption keys managed in a dedicated service, separate from the database. No upstream account is ever handed to a client.

  3. GDPR and a reachable DPO

    A data protection officer answers at dpo@vesperid.com. Our processing, retention periods and transfers are described in the privacy policy.

  4. No secret retained

    We keep neither the value of a password, nor that of a session cookie, nor a full card number; metadata only. A sensitive item is viewed on demand, after re-authentication, with a stated reason and an audit entry.

  5. Vulnerability disclosure

    Our security.txt file states how to report a vulnerability to us and which languages we answer in.

  6. A person, not a form

    Every request gets a personal reply from an analyst within one working day, public holidays excepted, from a named address.

  • French cybersecurity company

    VesperID SAS is a company incorporated under French law: the platform is built and operated by its own teams, and the contract falls under French and European law.

  • Per-client isolation

    One isolated space per organisation, enforced in the database; encryption keys managed in a dedicated service, separate from the database. No data is shared between clients.

  • No password or cookie kept

    Metadata only; a secret is viewed on demand, and the viewing is logged.

  • Reply within one working day

    Every request gets a personal reply from an analyst within one working day, public holidays excepted.

How this site is written

The pages of this site are written and reviewed by the VesperID team, analysts included. Every figure comes from a public report named, dated and linked next to it; we invent no statistic, no case study and no testimonial, and no client is named, not even in an anonymised but recognisable way.

Examples and the figures on the screens are fictional and labelled as such. Every page carries its last revision date in the sitemap; the guides carry their publication and update dates. A mistake, an imprecision? Write to us: we correct it and we say so.

Where we stand on sovereignty

VesperID is a French cybersecurity company, incorporated under French law, whose platform is built and operated by its own teams. One isolated space per organisation, enforced in the database; encryption keys managed in a dedicated service, separate from the database; backups encrypted before upload.

We prefer precision to slogans. Data stored and backed up at Scaleway SAS, in Paris. Traffic passes through Cloudflare’s network, intelligence collection relies on a provider established in Canada, error reporting is processed in the Union by an American vendor: the transfer instruments are described in the privacy policy. Advertising a “100% French” chain would be untrue, and you would find out at the first audit.

What we do guarantee is more concrete: the company, the platform, the analysts and the contract fall under French and European law; a data protection officer can be reached directly. Our infrastructure and service sub-processors are named in our privacy policy. Our intelligence collection provider is not named there, out of caution and by contract; its location, its role and the transfer safeguards are described, and our DPO answers any question from your own data protection officer.

How we work with our clients

Few clients, followed over time, with a contact who knows the file. That model limits our growth; it is the condition for the quality we promise.

  1. 01

    A named analyst

    You speak to the person who follows your file, not to a support desk discovering it. The same person handles your investigations and takedowns, and runs your periodic review.

  2. 02

    Honest scoping

    If your exposure does not justify a service, we say so before the proposal. A client paying for silence eventually leaves, and rightly so.

  3. 03

    No forced lock-in

    Your detections, reports and perimeter export at any time to CSV or JSON. An annual commitment must not become a technical trap.

  4. 04

    Saying what did not work

    A refused takedown, a false positive we sent, a late detection: these appear in the report just like the successes. It is the only way to improve together.

Our values

  1. 01

    Sobriety

    Fear is a poor decision-making tool. We describe what we observe, with its date and its source, without drama and without countdown timers.

  2. 02

    Precision

    Every statement must be sourceable. What we do not know is marked as such, in our alerts and on this site alike.

  3. 03

    Discretion

    We never name a client, never tell a recognisable story, never quote a figure drawn from their data. A sales reference is never useful enough to justify that risk.

  4. 04

    Usefulness

    Information that does not enable action has no place in an alert. It can go in a digest, a report, a conversation, not in a notification that interrupts someone.

Our commitments

  1. No secrets retained

    We never keep the value of a password, the hash supplied by the source, the value of a session cookie or a full card number. We keep metadata (the account concerned, the source, dates, hash type, the length of a cleartext password, counters) and, for mentions, a short, masked excerpt of the publication. What we do not keep cannot leak from our databases or be resold; we answer legal requests only under the conditions provided by law.

  2. Your data serves only you

    No client data feeds a public statistic, a commercial database or a shared model. We publish no figures derived from our clients, aggregated or otherwise.

  3. Documented transfers

    Our infrastructure and service sub-processors are named in our privacy policy, with their location and the applicable legal framework. Our intelligence collection provider is not named there, out of caution and by contract; its location, its role and the transfer safeguards are described.

  4. Responsible disclosure

    We publish a security contact address and a security.txt file, we acknowledge reports and we take no action against good-faith research. A good-faith report can also be addressed to ANSSI, under article L2321-4 of the French defence code.

We publish no team page. Our analysts work on sensitive files, and their public exposure would create a risk for them and for our clients. You will meet the person who will follow your file from the very first conversation.

Let us talk about your exposure

A one-hour conversation is enough to know whether we are useful. We will tell you plainly, including when the answer is no.

Request an exposure assessment

Bespoke offering: one price per service, no public price, no packages.