Origin continuously checks your domains and APIs from the outside, explains what matters in plain English, and turns every scan into signed evidence you can hand to customers, assessors and insurers.
Scans never run against anything you haven't proven you own. Re-checked at every job start.
Every pack carries a tamper-evident manifest your reviewer can verify independently.
Every scan, suppression and export is on the record. Nothing can be quietly edited.
Your data stays in London (AWS eu-west-2). A straight answer for your due-diligence form.
Add a DNS record to prove you own the domain. That's the whole setup — no agents, no code changes.
Origin maps your external surface: subdomains, services and APIs — including the ones you forgot about.
Safe, rate-limited external checks of TLS, DNS posture, headers, exposed services and your web & API surface — on a schedule.
Findings become prioritised work; scans become signed evidence packs you can forward the day someone asks.
One deduplicated list, worst first. Every finding pairs a plain-English explanation and remediation steps with the verbatim evidence it came from — so your engineer, your account manager and your assessor all read the same truth.
Your API’s certificate is signed with SHA-1, which browsers and clients no longer trust. Customers connecting to your API may see security warnings or hard failures.
Schedule weekly or monthly scans and Origin keeps watch: new subdomains join the inventory, regressions get caught, and your evidence trail grows on its own.
Reissue the certificate with SHA-256. If using ACME/Let’s Encrypt, renew with current defaults; confirm the chain with the re-scan button.
Our API’s security certificate uses outdated technology that modern systems are starting to refuse. If unaddressed, customer integrations could fail with security warnings. The fix is routine for the engineering team — no customer action needed, no data was exposed.
Assigned to Sam · expected to resolve this week · will appear as “resolved” in the next evidence pack.
Automated external checks are affordable, repeatable and useful — and they are not a substitute for skilled manual testing. We'll never pretend otherwise, and your evidence packs say exactly what was checked.
Deterministic scanners find; AI explains. Every AI-written sentence sits next to the raw evidence it came from, and anything that can’t be traced to evidence is dropped, not shown.
Ownership is verified before any scan, and re-verified every time one starts. Safe-by-default rate limits mean we never hammer your production systems — or anyone else’s.
Every plan starts with a 14-day trial. No card required.
Verify a domain and run your first scan this afternoon.