PALEONEvolving Technology
Try the demo Request access

A security review for your business

See your business the way an attacker does.

Paleon checks what attackers can see of your business online: your web addresses, email settings, open doors, exposed files and certificates. It doesn't break or change anything. You then get a clear plan of what to fix today, this week and later, who should do it, and roughly how long most fixes take.

Request access Try the demo
What an attacker seesSample
  • HighThe website certificate has expiredVisitors get a security warning.
  • HighCode history files can be downloaded/.git/config can be read.
  • MediumEmail can be faked in your nameSpoofing protection is set to monitor, not block.
  • MediumA door is left openA database port is open to the internet.
From our own test lab, paleon-lab-msp.com. Not a customer.
  • Nothing is broken or changed
  • Results are stored in AWS London
  • No technical knowledge needed

The attacker's view

What the internet can see about your business.

Paleon reviews what your business shows the internet. It needs no access to your computers or systems, and it never tries to break in or change anything. Open each area to see what we check.

Web addressesAn attacker could find an old test site you forgot to update.

What we check

  • Addresses listed in public certificate records
  • Subdomains named in other public sources
  • Common names such as dev, staging, test and old
EmailSomeone could email your customers pretending to be you.

What we check

  • SPF: which servers may send email for you
  • DKIM: whether your email is signed
  • DMARC: whether fake email is blocked, or reported and still delivered
Your domainIf it lapses, someone else could register it and receive your email.

What we check

  • When it is due for renewal, read from the registry
  • For endings such as .com, whether it is locked against being moved away
Doors left openAn attacker could try passwords on them from anywhere.

What we check

  • Databases such as MySQL, PostgreSQL, MongoDB and Redis
  • Remote access such as remote desktop and VNC
  • Management tools such as Docker, Kibana and Elasticsearch
Exposed filesAnyone could download them and read what is inside.

What we check

  • Code history, such as a .git folder
  • Settings files, such as .env
  • Backups, such as backup.zip

A file is reported once we confirm anyone can read it.

Keys in page codeSomeone could use a key to reach a service in your name.

What we check

  • Amazon Web Services (AWS) access keys
  • Payment keys, such as Stripe live secret keys
  • GitHub and Slack tokens, and private keys

Secret values are masked in your report.

CertificatesVisitors get a warning and may not trust your site.

What we check

  • Expired, or about to run out
  • Signed by the server itself, or not trusted by browsers
  • Issued for a different address
  • Old security versions and weak encryption
Lookalike domainsA name like yours could be used to fool your customers.

What we check

  • Registered names one letter off yours, or with letters swapped
  • Your name with extra words added, such as login, or a different ending

Listed for information, so you know they exist.

Why it matters

Attackers scan the whole internet for weak spots automatically. Being small does not keep you off their list.

How it works

  1. Request access

    Send us a short email about you, your business and your website.

    Takes a minute

  2. You get your personal invite

    We check your request, then email you an invite to create your account.

    Once we approve your request

  3. Prove the website is yours

    Add a short code to your domain settings, or a small file to your website.

    A few minutes, plus time for the change to show

  4. Paleon checks each address

    It finds your web addresses and checks each one without breaking anything.

    About 4 to 6 minutes on our test sites

  5. You get your Paleon Action Plan

    Every fix in order: today, this week and later.

    Ready when the review ends

  • Reviews start once you prove the website is yours
  • Results are stored in AWS London
  • Paleon never uses what it finds
  • UK company, number 17414280

What's in your Paleon Action Plan

One clear plan, written for the owner.

  • Every fix in order: today, this week and later.
  • The steps for each fix, wherever your domain is managed.
  • A PDF you can forward to whoever runs your website.
Paleon Action Plan, paleon-lab-msp.comSample

Today

  • Renew the website certificateWho: Your hosting companyHow long: About 15 minutes

This week

  • Block public access to the .git folderWho: Your developerHow long: Time depends on the fix
  • Replace the untrusted certificateWho: Your hosting companyHow long: About 15 minutes

Later

  • Stop others sending email that pretends to be youWho: YouHow long: About 10 minutes
  • Close services that should not be open to the internetWho: Your developerHow long: About an hour
  • Make browsers always use the secure version of your siteWho: Your developerHow long: About 15 minutes

Sample built from our own test lab. Not a customer. Each fix comes with its steps.

FAQ

Plain answers to what owners ask first.

Still have a question?

Write to founder@paleon.dev

Is this a penetration test?

No. Paleon shows you what an attacker can see and how to close each gap, without attacking anything.

How long does a review take?

About 4 to 6 minutes on our test sites. Sites with many web addresses take longer.

Do I need technical knowledge?

No. Your Paleon Action Plan is written without jargon, and you can forward it to whoever runs your website.

How do I get started?

Request access. Once approved, you get a personal invite by email. You will need access to your domain settings or website files to prove the website is yours.

Will it affect my website?

Paleon looks and connects. It never tries to break in or change anything.

Who makes the fixes?

You, your developer or your hosting company, depending on the fix. You can forward your Paleon Action Plan PDF to them.

What happens to anything Paleon finds?

Paleon never uses it. Secret values are masked in your report.

Where are my results kept?

Results are stored in AWS London. Read our privacy notice.

Request access

Once approved, you get a personal invite, create your account, prove your website is yours and run your review yourself.

Request access

This opens a short email for you to complete: who you are, your business, the website and why you would like a review. Please send it from your work email. Or write to founder@paleon.dev. We use these details to reply to you. Privacy notice.

Already have an account? Sign in.