Skip to main content
RelixQ
Menu
Request demo
Trust CenterAuthorized Scanning
Reliability & status
Trust Center
Public summaryDraft policy

Trust Center

Authorized scanning and Rules of Engagement.

RelixQ active validation is limited to systems, applications, repositories, domains, cloud accounts, and infrastructure the customer owns or is explicitly authorized to assess.

Access
Public
Scope
Customer authorization, active-validation scope, prohibited activity, operational safeguards, evidence handling, and emergency stop.
Last reviewed
Aug 17, 2026
Evidence owner
Product security owner
Approval role
Security and legal reviewer
Evidence posture
Operational evidence

Evidence posture

Operational evidence

Gated artifacts

Product authorization records are available in customer scope; the public policy remains under legal and operational review.

Evidence artifacts

  • Signed Rules of Engagement
  • Allowed and excluded targets
  • Rate and blackout configuration
  • Run and emergency-stop records

Framework relationships

Alignment is not the same as certification.

NIST Cybersecurity Framework 2.0

Vendor control mapping

Control-language mapping for buyer review; not a certification.

Official reference

Customer security and resilience programs

Customer evidence support

RelixQ artifacts can support an assessment; they do not certify the customer or provide a legal opinion.

Claim register

Public wording tied to evidence and review state.

Each statement carries its own scope, evidence posture, framework relationship, and review date. Roadmap language remains visibly separate from achieved controls.

Published claim

Written authority is required

The customer is responsible for obtaining written authorization from the system owner before active assessment. Public reachability, access, or possession of credentials does not by itself establish authority.

Documented practice
Scope
Every customer-requested active assessment.
Last reviewed
Evidence owner
Product security owner
Approval role
Security and legal reviewer

Evidence

Operational evidence

Authorization is represented in the signed project Rules of Engagement.

Review evidence artifacts
  • Authority attestation
  • Authorizing party
  • Signatory and validity period

Framework context

  • NIST Cybersecurity Framework 2.0

    Vendor control mapping — Control-language mapping for buyer review; not a certification.

Published claim

Allowed scope and exclusions

Every active run must define allowed targets and explicit exclusions. Exclusions take precedence, and validation must stop when a third-party or otherwise unauthorized boundary is detected.

Verified claim
Scope
Hostnames, repositories, cloud accounts, address ranges, services, regions, and time windows selected for active validation.
Last reviewed
Evidence owner
Product security owner
Approval role
Security and legal reviewer

Evidence

Operational evidence

The product persists and evaluates scope before and during an active run.

Review evidence artifacts
  • Allowed-target record
  • Exclusion record
  • Boundary-stop event
  • Scope validation result

Framework context

  • NIST Cybersecurity Framework 2.0

    Vendor control mapping — Control-language mapping for buyer review; not a certification.

  • Customer security and resilience programs

    Customer evidence support — RelixQ artifacts can support an assessment; they do not certify the customer or provide a legal opinion.

Published claim

Read-only safety boundary

Active validation is intended for read-only protocol and posture observation. Destructive testing, persistence, denial of service, credential attacks, data extraction, and bypass of safety controls are prohibited.

Verified claim
Scope
RelixQ active QAST and protocol-validation workflows.
Last reviewed
Evidence owner
Product security owner
Approval role
Security and legal reviewer

Evidence

Operational evidence

Safety configuration and run events support review of the assessment boundary.

Review evidence artifacts
  • Rate and concurrency ceilings
  • Blackout windows
  • Kill-switch state
  • Run event record

Framework context

  • NIST Cybersecurity Framework 2.0

    Vendor control mapping — Control-language mapping for buyer review; not a certification.

Published claim

Assessment evidence handling

Assessment evidence must be handled as confidential security information and retained only for the approved period. Final retention and deletion commitments remain governed by the applicable agreement and approved schedule.

Under review
Scope
Active-validation observations, target metadata, authorization records, findings, and reports.
Last reviewed
Evidence owner
Product security owner
Approval role
Security and legal reviewer

Evidence

Gated evidence

Customer assessment evidence is restricted and its final retention schedule remains under review.

Review evidence artifacts
  • Assessment record
  • Evidence access controls
  • Retention schedule draft

Framework context

  • AICPA Trust Services Criteria / SOC 2

    Assurance roadmap — Control mapping and examination roadmap only. RelixQ does not claim a completed SOC 2 examination.

  • ISO/IEC 27001

    Assurance roadmap — Information-security management roadmap only. RelixQ does not claim ISO/IEC 27001 certification.

Publication boundary

Status applies only to the scope and evidence shown above.

This page is a public summary. Detailed evidence may still require controlled access, an NDA, or an active procurement review. The catalog entry was last reviewed on .