Custodis continuously surveys your internet-facing estate, grades it A–F across five risk categories, and shows you exactly why — check by check, asset by asset.
Passive discovery: certificate transparency logs, DNS. We map every subdomain, certificate, and service you forgot you had — without touching your servers.
A documented pipeline of checks — TLS, DNS, mail, headers — each with a defined severity and weight. Deterministic, reproducible, no black box.
Findings with evidence, a 0–900 score with full history, and alerts when something changes in the night.
No vibes, no vendor magic. Every check that runs counts — the ones you pass as well as the ones you fail — and each carries a weight you can audit down to the arithmetic. Here is one category on a three-host estate:
| Check | Sev | Result | Math | Weight | |
|---|---|---|---|---|---|
| 1 | ENC-003 · Certificate not expired | CRIT | PASS | 10 × 3.00 | 30.0 |
| 2 | ENC-004 · HSTS header present | HIGH | PASS | 6 × 3.00 | 18.0 |
| 3 | ENC-001 · TLS 1.0 accepted | HIGH | FAIL | 6 × 2.00 × 1.10 | 13.2 |
| 4 | ENC-002 · Certificate expires in 12 days | MED | FAIL | 3 × 2.00 × 1.02 | 6.1 |
Scores on Custodis are never assigned by hand, estimated by a model, or adjusted for commercial convenience. They are computed — by a documented pipeline of checks, each with a written definition, a set severity, and the evidence behind its verdict kept on record.
When your grade moves, you can trace the movement to the exact check, on the exact host, at the exact timestamp. That is the whole product.
| Point-in-time auditthe old way | Custodisthe standing watch | |
|---|---|---|
| Cadence | Once a year, then silence | Every day — a change is caught by the next daily scan |
| Coverage | The assets you remembered to declare | Subdomains found in certificate transparency, without a list from you |
| Scoring | Auditor judgment, opaque | Deterministic checks with published scoring math |
| Regressions | Found at the next audit | Re-opened automatically, original date preserved |
| Pricing | "Contact sales" | Transparent monthly tiers, 14-day trial, no card |