Seven attack surfaces
Cryptography does not live in one place, so Enterprise does not scan one place. Seven surfaces are discovered, classified, prioritized, and tracked — and all seven normalize to the same finding contract, so evidence composes instead of fragmenting.
| # | Surface | What is found |
|---|---|---|
| 1 | Source code | Quantum-vulnerable primitives, weak hashes, hard-coded keys — AST analysis plus YAML rule packs |
| 2 | Dependencies | Vulnerable crypto libraries and transitive exposure, from manifests and full CycloneDX / SPDX SBOM ingest |
| 3 | TLS endpoints | Cipher suites, certificate algorithms, key sizes, expiry, HSTS, ALPN, key-exchange groups |
| 4 | Cloud KMS | AWS KMS, Azure Key Vault, GCP Cloud KMS — key algorithm, rotation policy, exposure |
| 5 | Cloud TLS infrastructure | ACM, Cert Manager, CloudFront, API Gateway, EKS, GKE, ALB, App Gateway, Front Door, APIM |
| 6 | Runtime telemetry | OpenTelemetry and Datadog spans — what actually runs in production, not just what was scanned |
| 7 | Graph correlation | Blast radius, migration simulation, attack-path projection, dependency-chain reasoning |
Managed SaaS processing boundaries
RelixQ delivers product workflows through the managed SaaS service. Customer-authorized connections and optional integrations determine which evidence enters the tenant and when.
| Workflow | Service handling | Customer control |
|---|---|---|
| The web application | Managed SaaS | Tenant access, dashboards, findings, inventory, quantum exposure, governance, and reports. |
| Scanning and analysis | Managed SaaS | Customers authorize connected repositories, scan scope, schedules, and credentials. |
| CLI evidence submission | Tenant API | Customers choose when to submit findings and when to apply CI gates. See Enterprise CLI. |
| The GitHub App | Connected integration | Customers authorize installation, repository scope, and push or pull-request triggers. |
The scope hierarchy
Enterprise models your estate as four nested scopes. The RelixQ Score is defined at every level; individual findings are not scored 0–100 — they carry a per-finding risk level instead.
- Organization
- The intended tenant boundary for members, billing, identity, and projects; production isolation status is governed by the Trust Center.
- Project
- The unit RelixQ scans. A project has a source, members, saved views, policies, and its own score.
- Application
- An optional grouping of services inside a project, for organizations shipping several deployables per project.
- Service
- The attribution target for findings. Service ownership is what turns a findings list into a work queue routed to the right team.
What you can rely on
Four behaviours are worth knowing because they explain what you will see on screen, and why.
- Tenant isolation is a layered design
- Requests and stored work are designed to carry one active organization context, with PostgreSQL RLS as the target database boundary. Production enablement and effectiveness remain under Trust Center review. Details in Security and tenancy.
- Findings are immutable facts
- A finding is never edited — it is superseded. Triage state lives separately with a full audit trail, so the record reconstructs what was known and decided at each point in time, not just the current state. This is what makes the audit trail defensible.
- Every signal degrades independently
- If one data feed is unavailable, its widget renders empty and everything else keeps working — never a crash, and never invented data. An empty widget means the signal is genuinely unavailable, which is a different thing from a zero.
- Detection rules are data, not code
- Rules ship as reviewable data and update without a release, so new coverage reaches your tenant continuously rather than on a deployment cycle.
Related pages
The CryptoFinding contract
The single schema every scanner normalizes to before its output crosses a boundary — the reason evidence from code, dependencies, TLS, cloud, and runtime composes instead of fragmenting.
Security model, tenancy and data handling
The intended tenant-isolation design, the two collection paths into the managed SaaS service, credential handling, active-probing consent, and the boundary between product architecture and production-verified assurance claims.
Getting started with RelixQ Enterprise
Sign in to your managed tenant, create an organization and a project, connect a source, run your first scan, and learn what each surface is for.