One business, one boundary
Each customer business is a separate tenant. Portfolio views require explicit grants for every business. Cross-business access is a release-blocking defect.
A security system built around proof
Know what was checked.
Know what changed.
Veyrspan Security is building a controlled path from asset inventory and findings to reviewed fixes, validation and evidence. The first target is small and midsize SaaS teams operating in the United States.
Phase-zero implementation. No customer scanning, remediation or monitoring service is live.
THE ASSURANCE LOOP01 / 04
01Define authorized scope
02Collect traceable evidence
03Review bounded change
04Verify independently
A finding stays open until the deployed revision and independent checks support closure.
Operating principles
Authority stays with the customer.
Automation can organize evidence and prepare a proposal. Every effect still depends on verified identity, exact scope, policy and human approval where required.
Changes are reviewed
The intended first release prepares tested draft pull requests. It does not merge code, deploy to production or take production containment actions.
Unknown stays visible
Unsupported assets, missing permissions, stale data and incomplete checks remain coverage gaps. A checklist cannot certify a system as secure.
Assessment design
Thirteen layers. Explicit limits.
The planned assessment records applicability, evidence, freshness and limitations for every control. These layers describe the design; they are not live scanning capabilities.
- 01Governance & inventory
- 02Identity & authorization
- 03Source & supply chain
- 04Application & API
- 05Data protection & residency
- 06Database & storage
- 07Network & edge
- 08Cloud & runtime
- 09CI/CD & release integrity
- 10Detection & response
- 11Resilience & recovery
- 12AI & agent security
- 13Independent assurance
Release transparency
Current build status
Available now
- Published product information, scope and release limits
- Phase-zero design and local synthetic fixture implementation
- Local functional and security test results recorded by the development team
Not yet live
- Customer login, integrations and evidence storage
- Isolated customer repository scanning
- Remediation pull requests and staging validation
- Continuous monitoring, incident response and commercial service
Customer assets are never scanned without verified ownership, written scope, safe limits and an authorized run. Production worker isolation and regional data controls must be independently verified before service enablement.