Straight answers

Only the invoicing and the contract. A client organisation is a company or an individual; the catalogue, the licences and the client area are the same. A licence is a named composition of services, any service can sit on any licence, and an organisation can hold several: one per subsidiary, one per brand, one per protected executive.

Because a published price assumes an identical offering for everyone, and ours is not. The real cost depends on the number of monitored identifiers, the services activated and the level of support. Advertising an entry price would mean quoting a figure almost nobody would actually pay. After scoping you receive a written proposal, itemised line by line.

No, and that is a design decision. A package forces you to pay for services you do not need in order to get the one you do. Each of the fifteen services, the two cross analyses included (exposure chains, exposed staff), has its own price, its own activation fee and its own quota unit, itemised line by line in the proposal. A licence is the composition you make of them, under a name, for one year: you activate what matches your exposure and adjust at renewal or during the year.

The licence is annual. The invoice is issued by VesperID and paid by bank transfer; there is no online payment. The licence is activated when payment is received, then the owner account is invited. Renewal is discussed before the term ends, with the year’s results in hand: no silent auto-renewal.

There is no self-service trial, because any monitoring requires prior verification that the assets are yours. Scoping, however, is free and concrete: we tell you what your perimeter suggests we would find and, where relevant, that the service is not justified in your situation.

Metadata: the account concerned, the source of an exposure, dates, hash type, the length of a cleartext password, indicators and counters, plus your declared perimeter and your users; for a mention, a short, masked excerpt of the publication. We never keep the value of a password, the hash supplied by the source, the value of a session cookie or a full card number. That choice limits what a compromise of our platform could expose.

VesperID, a French cybersecurity company, builds and operates its own platform. One isolated space per organisation, enforced in the database; encryption keys managed in a dedicated service, separate from the database; backups encrypted before upload. Our infrastructure and service sub-processors are named in our privacy policy, with the legal framework of every transfer; our collection provider, established in Canada, is designated there by its function.

No. Your data is used to deliver the service, for invoicing and for platform security, and for nothing else. We build no commercial database from your detections, we publish no statistics derived from our clients, and we never name a client, including in an anonymised but recognisable way.

From your personal area for account export and erasure, or in writing to dpo@vesperid.com. An erasure request is validated by an administrator other than the requester, then executed: user data is pseudonymised, while invoices and the audit log are retained under legal obligations.

Nothing. No agent, no probe, no connector to your directory, no access to your logs. Monitoring is entirely external. If you want alerts inside your tools, an outbound channel is enough: email, Slack, Teams or webhook.

Monitoring starts asset by asset, from the first successful verification. In practice a first domain can be verified within minutes once the DNS record is published, and the history available on that asset is pulled in immediately. Completing a whole perimeter (addresses, people, keywords, alerting channels) usually takes a few days, at your pace.

By publishing a TXT DNS record containing a token unique to you. Verification then happens automatically. This step is not a formality: it guarantees that nobody can have a domain monitored that is not theirs, including a competitor’s.

A person is monitored by name only after accepting the invitation themselves; without that acceptance, the organisation monitors only the work accounts it controls, after informing its staff. Monitoring a person (private addresses, personal accounts, personal devices) goes through a separate protection profile with its own access control: the protected person alone sees their data, decides who else may and ends the monitoring whenever they wish, even when the company pays.

On desktop (Windows, macOS, Linux) and on mobile (iPhone, iPad, Android). The client area installs from the browser, in one tap, with no app store involved, and updates itself automatically. The account, the rights and the security are the same on every device: two-factor authentication, session code lock, audit log.

The exposure score, from 0 to 100, is recomputed at every synchronisation from the open findings, their severity, their freshness and the criticality of the assets touched; its factors stay readable and its curve covers 90 days. Priorities rank findings by severity, freshness, asset criticality and target handling time, from 4 hours to 90 days by default depending on severity, adjustable; our contractual commitments are in the terms and conditions.

Yes, that is what the Exposure chains service does. A graph links devices, credentials, sessions, lookalike domains, exposed hosts, executives, suppliers and breach sources; every chain states a probable origin with its confidence (infected workstation, third-party breach, password reuse, phishing campaign, supplier compromise, exposed service), its possible impacts and the recommended playbook. Chains are recomputed every fifteen minutes.

Yes, that is the Exposed staff service, a security aid and nothing else. Every account of your domains is aggregated (leaks, usable passwords, stealer logs, live sessions, exposed personal data, suspected reuse), receives a probable role inferred from your perimeter, an exposure score and a single recommended action, then joins a cohort: awareness recommended, device to reinstall, access to harden, to watch or no exposure. The list of exposed accounts and the recommended action exports for the security team, to organise resets, reinstalls and awareness sessions; the actions taken (briefed, device reinstalled, access hardened, sessions revoked) lower the score. Our data cannot prove MFA is on: “access to harden” flags a usable password on a sensitive target with no proof of a second factor.

It depends on your actual exposure, and we refuse to quote a reassuring average. What we control is the settings: minimum severity per channel and per recipient, quiet hours, grouping of non-critical cases into digests. The first few weeks are spent tuning those thresholds. A week with no alert is a result, not an outage.

Email, Slack, Teams or an outbound webhook to your own system. Each channel has its recipients and its severity threshold: your on-call team can receive only critical cases while the daily digest goes to a wider list.

It is sent automatically according to your rules, with its severity and the expected action. You decide whether quiet hours apply to critical cases: some organisations want to be woken for an exposed secret, others prefer to handle it in the morning. That setting is yours, not ours; an analyst qualifies the case at your request.

We contribute the external view, what leaked, since when, what is circulating, which access is involved, as a written investigation note if needed. We do not act on your systems and do not replace an incident response team; we routinely work alongside the one you appoint.

Two-factor authentication is mandatory for our staff and for organisation owners and managers; it is available to every member and can be imposed on everyone by the organisation. On top of it: session management with revocation, per-user roles and scopes, application locking on mobile, and an audit log of sensitive actions (reveal, export, status and role changes). Your organisation’s administrators can revoke a session or disable an account immediately.

Isolation is enforced in the database itself, at record level, on top of the filters applied by the application. The technical account that runs queries cannot bypass those rules. Automated tests check on every build that no table holding client data escapes that mechanism.

It is never automatic. The item is fetched on demand, masked by default, restricted to authorised roles and to accounts of your verified perimeter, gated by recent re-authentication, tied to a reason entered by the user, logged, and subject to a quota of twenty reveals per person per day. Nothing is cached, and the value of a third-party service’s cookie is never revealed.

Write to security@vesperid.com; the address and the terms are also published in our security.txt file. We acknowledge receipt, keep the reporter informed of progress, and take no action against good-faith research that does not degrade the service or access client data. A good-faith report can also be addressed to ANSSI, under article L2321-4 of the French defence code.