1. What Posture Share and the Assessor Portal Are
Posture Share lets an organization that uses the WASViking platform (the "Vendor") share an aggregated, signed view of its security posture with the people who assess it: a customer's security team, a third-party risk analyst, an auditor (the "Assessor"). The Assessor Portal is where an Assessor reads, in one place, what every Vendor that invited them chose to share.
This page describes who decides what, what is shared and what never is, and how access is controlled and recorded. It complements the Assessor Portal Terms of Use and the Assessor Portal Privacy Notice.
2. Who Decides What
- The Vendor decides whom to invite, which scope to share, at which disclosure level and for how long, and can end an access at any time.
- The Assessor reads and downloads what was shared. Nothing in a shared space can be edited by the Assessor.
- WASViking measures, signs and serves the figures. WASViking does not grant, extend or restore access on a Vendor's behalf, and does not show an Assessor anything the Vendor did not choose to share.
The Assessor Portal is free of charge for the Assessor, who signs no commercial agreement with WASViking. Opening a shared space scans nothing, in the Vendor's environment or in the Assessor's: the figures were already measured and signed.
3. What Is Shared, by Disclosure Level
Every Posture Share carries one disclosure level, chosen by the Vendor for that share:
- Minimal: the posture score, its trend and how recent the assessments are.
- Standard: adds severity counts, issue categories, recent activity and the breakdown of open, accepted and remediated findings.
- Detailed: adds remediation performance and service level figures.
A Vendor may also enable a findings register on a specific share. It lists findings one by one by type, severity, status and dates, without asset or technical detail. It is off unless the Vendor turns it on for that share.
The same level applies everywhere the Assessor meets that Vendor: the shared space, the portfolio page, the downloads and the notification emails.
4. What Is Never Shared
Whatever the disclosure level, a Posture Share never carries:
- Vulnerability details, proof of concept, payloads or affected addresses;
- Asset names, addresses, software inventory or counts of servers;
- Credentials, secrets or raw evidence collected by the platform;
- Personal data found by the platform during an assessment.
An Assessor works with security results, not with the Vendor's private data, and therefore does not take custody of that data.
5. Signed and Verifiable
Each version of a Posture Share is signed by the platform with a key held only by WASViking, and carries a verification address. Anyone holding a page, a PDF or a statement can open that address and confirm that the figures were issued by WASViking and were not altered. A version, once signed, is never recalculated: history shows what was true on each date.
Signature times, watermarks, PDFs and CSV files always state UTC, so everyone reads the same instant.
A Posture Share is evidence produced by automated assessments. It is not a certification, an audit opinion or a statement of compliance with any framework.
6. How Access Is Controlled
- An Assessor account is created only from a Vendor's invitation to a specific email address. There is no open registration.
- There is one sign-in address. The first sign-in uses a temporary password made for that invitation, stored only as a one-way hash, valid for a limited time and erased once the account exists.
- Two-factor authentication with an authenticator app is mandatory for every account, with single-use backup codes.
- Repeated wrong attempts lock the account for a growing period, and credential pages are protected against automated abuse.
- A session ends on its own after 8 hours, and an Assessor can sign out of every other session.
- A share expires on the date the Vendor set, within a maximum lifetime of 180 days, and the Vendor can revoke it or remove an invitation at any time, with immediate effect.
- One Assessor can never open a Vendor that invited someone else, and a Vendor never sees which other Vendors an Assessor follows.
7. What Is Recorded
Every visit and every download in a Vendor's shared space is recorded for that Vendor with the Assessor's email address, the time and the network address, including the first time the space was opened. Pages and downloads carry a watermark that identifies the access. The Assessor's acceptance of the Assessor Portal documents is recorded with the version, a fingerprint of the exact text, the time, the network address and the browser.
8. Personal Data and Retention
For the invitation, the Vendor is the controller of the Assessor's email address and WASViking acts as its processor. For the account the Assessor creates, WASViking is the controller. An Assessor can delete the account at any time. Invitations and access records stay in the Vendor's records until the Vendor removes them, the share is deleted or the Vendor's own data is erased. Details are in the Assessor Portal Privacy Notice.
The Assessor Portal runs on the same infrastructure and subprocessors as the rest of the WASViking platform, under the same safeguards for international transfers.
9. Contact
Questions about this page: [email protected]. Privacy requests: [email protected].