Security & trust

A phishing tool you can trust with your directory.

We send fake attacks for a living, so we hold ourselves to the rules a real attacker never would.

RULE 01Only your people. Ever.Practice emails can only go to employees synced from the workspace you connect. There is no free-text recipient field anywhere.

RULE 02No real brands.Lures use generic, made-up senders. We never impersonate a real company or use its logo.

RULE 03Always identifiable.Every practice email carries an X-Lureproof-Simulation header naming your organisation, so IT can always tell.

Controls

ACCESSAdmin-only sign-inConnecting proves admin rights, because the directory API is admin-only. Personal accounts are rejected.

ACCESSRead-only, least privilegeWe read names, emails and account status. Never mailbox contents, files, calendars or passwords.

ENCRYPTIONTokens encrypted at restProvider refresh tokens are encrypted with AES-GCM before they're stored.

SESSIONSHashed, httpOnly sessionsSessions use httpOnly cookies. Only token hashes are stored — never the tokens themselves.

EMAILSeparate lure domainsPractice emails send from dedicated domains with SPF, DKIM and DMARC, through a provider that permits authorised simulations.

LIFECYCLELeavers drop offPeople removed or suspended in your directory become inactive automatically. Exclude anyone any time.

DATA QUALITYScanner-safe trackingClicks are recorded by the lesson page, not the link, so security scanners don't produce false clicks.

PEOPLEBlame-free by designLessons never shame. The goal is a team that reports, not a team that hides mistakes.

INDEXINGLesson pages are privateLesson pages are marked noindex and tied to single-use tokens.

Found a vulnerability?

We welcome responsible disclosure. Email us with details and we'll respond quickly.

security@lureproof.com

Safe for you. Annoying for attackers.

Start free →