Tamper-evident certificates
Every certificate is digitally signed and carries a SHA-256 hash. Any change to the record breaks the signature, so auditors can trust what they read.
Home / Security
Security built into every erasure
The proof of erasure is only as trustworthy as the system that produces it. Here is how VaultRazer protects your records, and how to report a security issue to us.
Product security
Controls you can show your auditors
Verified, not assumed
Full or sampled read-back confirms each erasure. A drive that fails erasure or verification never receives a successful certificate and is flagged for destruction.
Access control
Role-based permissions, SAML 2.0 single sign-on and multi-factor authentication control who can run erasures, change policies and read records.
Full activity log
The Console keeps a full activity log, so you can trace who did what and when. Send events to your SIEM through webhooks or the REST API.
Your choice of hosting
Run the Console in the VaultRazer cloud, on your own servers, or in a fully air-gapped environment where no record leaves your network.
Trusted boot
Drive Eraser boots from USB, ISO or PXE on UEFI systems with Secure Boot enabled, as well as legacy BIOS, without relying on the installed operating system.
How to report a vulnerability
If you believe you have found a security vulnerability in VaultRazer software, the VaultRazer Console or this website, email security@vaultrazer.com. Please include:
- the product, version or URL affected;
- a description of the issue and its potential impact;
- step-by-step instructions or a proof of concept that lets us reproduce it;
- how you would like to be credited, if at all.
Please do not include real customer data in your report, and give us a reasonable chance to fix the issue before you disclose it publicly.
Scope
In scope: VaultRazer erasure software, the VaultRazer Console, its APIs, and websites operated by VaultRazer.
Out of scope:
- denial-of-service, load or volumetric testing;
- social engineering, phishing or physical attacks on our staff, offices or customers;
- accessing, changing or deleting data that isn’t yours, beyond the minimum needed to show the issue;
- findings from automated scanners without a demonstrated impact;
- third-party services we use but do not operate.
Safe harbor
If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue legal action against you for it, and we will work with you to understand and fix the issue quickly. If a third party brings legal action over research that followed this policy, we will make it known that your activity was authorized.
What to expect from us
- We will acknowledge your report within 3 business days.
- We will confirm whether we can reproduce the issue and keep you informed while we fix it.
- We will tell you when the issue is resolved and, with your permission, credit you for the discovery.
This policy does not offer monetary rewards.
Security documentation for customers
Customers and prospective customers can request our security documentation or send us a security questionnaire through their account contact or sales@vaultrazer.com. For how we handle personal data, see our Privacy policy.