1. What Posture Share and the Assessor Portal Are
Posture Share lets an organization that uses the WASViking platform (the "Vendor") share an aggregated, signed view of its security posture with the people who assess it: a customer's security team, a third-party risk analyst, an auditor (the "Assessor"). The Assessor Portal is where an Assessor reads, in one place, what every Vendor that invited them chose to share.
This page describes who decides what, what is shared and what never is, and how access is controlled and recorded. It complements the Assessor Portal Terms of Use and the Assessor Portal Privacy Notice.
2. Who Decides What
- The Vendor decides whom to invite, which scope to share, at which disclosure level and for how long, and can end an access at any time.
- The Assessor reads and downloads what was shared. Nothing in a shared space can be edited by the Assessor.
- WASViking measures, signs and serves the figures. WASViking does not grant, extend or restore access on a Vendor's behalf, and does not show an Assessor anything the Vendor did not choose to share.
The Assessor Portal is free of charge for the Assessor, who signs no commercial agreement with WASViking. Opening a shared space scans nothing, in the Vendor's environment or in the Assessor's: the figures were already measured and signed.
3. What Is Shared, by Disclosure Level
Every Posture Share carries one disclosure level, chosen by the Vendor for that share:
- Minimal: the posture score, its trend and how recent the assessments are.
- Standard: adds severity counts, issue categories, recent activity and the breakdown of open, accepted and remediated findings.
- Detailed: adds remediation performance and service level figures.
A Vendor may also enable a findings register on a specific share. It lists findings one by one by type, severity, status and dates, without asset or technical detail. It is off unless the Vendor turns it on for that share.
The same level applies everywhere the Assessor meets that Vendor: the shared space, the portfolio page, the downloads and the notification emails.
4. What Is Never Shared
Whatever the disclosure level, a Posture Share never carries:
- Vulnerability details, proof of concept, payloads or affected addresses;
- Asset names, addresses, software inventory or counts of servers;
- Credentials, secrets or raw evidence collected by the platform;
- Personal data found by the platform during an assessment.
An Assessor works with security results, not with the Vendor's private data, and therefore does not take custody of that data.
5. Signed and Verifiable
Each version of a Posture Share is signed by the platform with a key held only by WASViking, and carries a verification address. Anyone holding a page, a PDF or a statement can open that address and confirm that the figures were issued by WASViking and were not altered. A version, once signed, is never recalculated: history shows what was true on each date.
Signature times, watermarks, PDFs and CSV files always state UTC, so everyone reads the same instant.
A Posture Share is evidence produced by automated assessments. It is not a certification, an audit opinion or a statement of compliance with any framework.
6. How Access Is Controlled
- An Assessor account is created only from a Vendor's invitation to a specific email address. There is no open registration.
- There is one sign-in address. The first sign-in uses a temporary password made for that invitation, stored only as a one-way hash, valid for a limited time and erased once the account exists.
- Two-factor authentication with an authenticator app is mandatory for every account, with single-use backup codes.
- Repeated wrong attempts lock the account for a growing period, and credential pages are protected against automated abuse.
- A session ends on its own after 8 hours, and an Assessor can sign out of every other session.
- A share expires on the date the Vendor set, within a maximum lifetime of 180 days, and the Vendor can revoke it or remove an invitation at any time, with immediate effect.
- An Assessor is a company, and a Vendor may not know which of its people to invite. An invitation therefore belongs to the Assessor's organization: once the invited person is a member of an assessor organization in the Assessor Portal, every member of that organization can open that Vendor's shared space. Each member signs in with their own password and their own two-factor authentication, never with a shared credential, and the Vendor's access log names the person behind every visit. Membership is decided by the owner or an administrator of that organization, never by an email domain alone, and a person who leaves or is removed loses access at once while the organization keeps it. Addresses at public mailbox providers never form an organization.
- An assessor organization can prove that it controls an email domain by publishing a DNS record that WASViking gives it. The challenge in that record is unique to that organization and that domain, so the record of one organization never proves the domain for another, and one domain is proven by one organization only. The proof is checked again every day and ends when the record is gone for several days in a row. Once a domain is proven, an invitation a Vendor sends to any address of that exact domain belongs to that organization from the start, whoever was typed (a colleague, a shared mailbox, a person who left), and the owner and the administrators of that organization are told. The typed person opens it once a member of that organization. An organization with a proven domain also has an Assessor ID, a handle it can give to its Vendors so that they invite the organization itself, with no email address to mistype. The Assessor ID opens nothing by itself, can be replaced at any time, and stops working when the organization no longer has a proven domain.
- Before an invitation is sent, the Vendor is shown what WASViking knows about what it typed and must confirm it: a domain proven by an assessor organization together with the name that organization gave itself, a personal mailbox, or nothing. WASViking verifies the domain, never the name of an assessor organization, and says so on that page. The Vendor is never shown whether a person has an account, who the members of an organization are, or how many they are before its shared space was opened. Each of these look ups is recorded in the Vendor's own audit trail and limited per hour. The same reading and the same confirmation happen when a new share is created, before it exists and before anything is sent. When an invitation reaches an assessor organization because the invited person is a member of it, the Vendor is told by email, at the latest when its shared space is first opened, with how many people can open it and the domains that organization proved, never with the name the organization gave itself.
- An assessor organization that proved a domain can ask a Vendor for a Posture Share by typing the Vendor's domain. WASViking never tells an Assessor whether a company is a customer: every request gets the same answer after the same minimum time, nothing is emailed at that moment, and the request reads as waiting until it expires unless a Vendor chooses to approve it. A decline, a block and a Vendor that stopped taking requests all look the same to the requester. A request reaches a Vendor only through a domain that Vendor proved by DNS, never through a domain somebody merely declared, so nobody can receive a request, and be assessed, in a Vendor's place. A request carries no free text: the purpose comes from a fixed list and the optional reference is a short code of letters, digits and dashes. A request shares nothing by itself: a Vendor that approves creates an ordinary share and chooses the level of detail, the domains and the expiry. A Vendor is told about waiting requests in one digest a day, which carries a count and the proven domains of who asked, never a name an organization chose. A Vendor can decline, block an assessor organization, or stop taking requests at any time. A Vendor may also publish a request code, for example on its security page, so that a customer asks by typing that code instead of a domain. Publishing it is the Vendor's own choice to say that it uses WASViking; a code nobody has gets the same answer as any other request, so codes cannot be probed, and the Vendor can replace the code or stop using one at any time.
- The Vendor keeps the last word: it can restrict any invitation to the invited person only, at the time of the invitation or later, with immediate effect, and removing an invitation ends it for everyone who could open it.
- Nobody outside the organization of the invited Assessor can open a Vendor's shared space, and a Vendor never sees which other Vendors an Assessor follows.
7. What Is Recorded
Every visit and every download in a Vendor's shared space is recorded for that Vendor with the email address of the person who made it, the time and the network address, including the first time the space was opened. When that person is a member of an assessor organization, the record also names the organization and, when it was a colleague of the invited person, the address that was invited. The Vendor is told the name of that organization and how many people can open the invitation only after the space was opened for the first time. Pages and downloads carry a watermark that identifies the access. The Assessor's acceptance of the Assessor Portal documents is recorded with the version, a fingerprint of the exact text, the time, the network address and the browser.
8. Personal Data and Retention
For the invitation, the Vendor is the controller of the Assessor's email address and WASViking acts as its processor. For the account the Assessor creates, WASViking is the controller. An Assessor can delete the account at any time. Invitations and access records stay in the Vendor's records until the Vendor removes them, the share is deleted or the Vendor's own data is erased. Details are in the Assessor Portal Privacy Notice.
The Assessor Portal runs on the same infrastructure and subprocessors as the rest of the WASViking platform, under the same safeguards for international transfers.
9. Contact
Questions about this page: [email protected]. Privacy requests: [email protected].