Security model

SheerSight is built for exactly the kind of team that worries about supply-chain and vendor risk — so the platform is designed to need as little trust as possible. Here's what that means for you, in plain terms.

We don't hold your secrets

The control plane stores no long-lived host secrets. Any credentials you provide (for the sources a host collects from) are encrypted in your browser before they're sent. The platform only ever relays ciphertext; the agent on your host decrypts them locally. Nobody in the middle — including us — can read them.

Your hosts stay closed

Agents connect outbound only. There are no inbound ports to open on your hosts, no port-forwarding, and no public IP required. That removes an entire class of exposure.

Every action is signed and constrained

• Instructions sent to an agent are cryptographically signed and verified by the agent before it acts.
• Agents run only a fixed allow-list of actions — never a shell or arbitrary commands. Even a compromised console cannot make a host do something outside that list.

Access is Zero-Trust

The console sits behind Zero-Trust access control (SSO / one-time PIN), and that check is enforced at the application layer — a request that skips the front door is rejected even if it reaches the backend.

Least privilege throughout

Tokens and access are scoped to the minimum needed, and monitoring data is minimized/de-identified where it doesn't need to carry identifying detail.

Reporting a vulnerability

Found a security issue? Please contact us at security@sheersafe.com with details so we can address it quickly. (Update this address/process as needed.)