Response time
Within 2 business days during the beta.
Security reports are acknowledged within 2 business days. See Security.
What to include
Your domain, the report date if it's about a report, and what you expected to see.
Common questions
When will I get access?
We invite teams from the waitlist in small batches and email you when your place opens. Your first scan and report are free.
I think my report is wrong.
Email us the report date and what you think is wrong. A person will review it. If you've changed your configuration since the scan, we can scan again.
Can you tell us what to fix?
No. Shorward reports what it measures and doesn't advise or recommend changes. Each finding cites the public guidance it relates to, so your team or your own advisers can decide.
How do I verify a domain for monitoring?
Add a DNS TXT record, shorward-verify=<your account id>, on the domain. We'll give you the exact value when your account opens.
Your scanner is hitting my server and I'm not a customer.
See Our scanner. It makes a handful of standard TLS handshakes and nothing more. Email us and we'll stop scanning your domain.
How do I delete my data or leave the waitlist?
Email us from the address you signed up with. We'll confirm deletion within one month, usually much sooner.
Do you have a security questionnaire, DPA or subprocessor list?
The DPA and subprocessor list are public. For questionnaires, email us.
Accessibility
We aim to meet WCAG 2.2 AA. All animation respects your system's reduced-motion setting. If something on this site doesn't work with your assistive technology, email us and we'll fix it or give you the information another way.