Your database, or ours
Assets, findings, risks and evidence live in a security database. Connect a PostgreSQL database that you control, or use one that we provision. You can migrate to your own at any time.
Trust and security
Your security data stays yours. So do the connections to it.
SecureGraph runs the orchestration, identity, billing and tooling. The record of your posture lives in a security database: your own, or one that we provision. It holds your assets, scans, findings, risks and investigation detail. If you start on ours, you can migrate to your own at any time.
Only SecureGraph can connect
A publicly hosted security database must accept connections only from SecureGraph's addresses. If an address is added, the product tells you your allowlist is out of date.
Nothing reaches into your network
On a private network, the SecureGraph connector runs next to your database and connects outward. No inbound port has to be opened.
Least-privilege integrations
The GitHub App reads repositories and never writes to them. It uses short-lived installation tokens, not long-lived secrets.
Code analysed, then deleted
Repositories are cloned into temporary workspaces that are destroyed afterwards. The AI sees findings, not your source tree.
Two people for risky actions
High-impact actions can need an initiator and a separate authorizer. Every action is recorded with who started it, who approved it, and when.
Two databases, one clear line.
Data flows one way: into your security database, yours or ours. SecureGraph reads what it needs to run a scan, and writes the result back to your side of the line.
SecureGraph platform
- Organization, users and roles
- Billing and entitlements
- Dual-control and audit metadata
- Tooling catalog and orchestration
Your security database
- Assets and inventory
- Scan results and findings
- Risks and treatments
- Compliance evidence and report source data
Never touched
- Production ERP and CRM rows
- Customer PII datasets
- Application table contents
- Anything outside the scope you authorize
What the architecture commits to.
The rules behind every report, every agent and every test.
Verification before reputation
We never present unverified noise as confirmed executive risk. Heuristic probes stay in an appendix.
AI data care
Raw tenant security content isn't sent to external models by default. SecureGraph prefers local and minimized paths, and logging and approval apply where escalation is necessary.
Authorized testing only
You define scope, and you are responsible for holding the rights to test the targets you connect. SecureGraph provides the controls; you provide the authorization.
Evaluating us
Questions worth asking.
- 01Ask to see the privacy model. The boundary on this page shows it.
- 02Ask how reports treat unverified findings.
- 03Ask who can run sensitive tests, and whether SecureGraph enforces approvals.
- 04Ask where backups of your security database live: with you or with your infrastructure provider.
We answer plainly, including the parts that are still maturing.
Compliance posture
A platform for your program.
SecureGraph helps you map controls and collect evidence across ISO-, PCI- and SOC 2-oriented packs as they become available. It also keeps an append-only audit trail that you can export.
It is not a substitute for certification. We help you build the case; auditors still audit. The architecture was designed with privacy obligations such as Nigeria's NDPA in mind.
Bring your security reviewer.
We will show the data boundary, the approval gates and the audit trail in the live product, not a slide.