Try it on your own estate.
A workspace of your own: run scans, build a cryptographic inventory, see your harvest‑now‑decrypt‑later exposure and generate the evidence your auditor asks for. Free, like everything else here — no card, no call, and nothing to upgrade to.
Before you fill anything in
If you only want to know what your public endpoint negotiates today, you do not need an account at all. The free readiness check answers that in about fifteen seconds, keeps a permanent record you can link to, and gives you a badge for your README. Start there; come back here when you want your whole estate rather than one endpoint.
What a trial includes
A workspace nobody else can see, with your own users, API keys and retention settings. Tenant isolation is enforced by the database itself, not only by the application — see security.
Repository, TLS endpoint, certificate and configuration scanning against targets you authorize, producing the full inventory and a CycloneDX CBOM. There is no reduced version of the product: this is the product.
Findings carry what was observed, how it was classified, and against which standard — FIPS 203/204/205, NIST and CNSA 2.0 deadlines. A model is labelled as a model.
Your workspace has API and scan rate limits. They exist because this is a free service run on finite capacity — not because a larger plan is being withheld, since there is no paid tier. Every API response carries X‑RateLimit‑Limit and X‑RateLimit‑Remaining so you can see where you stand without guessing, and a refusal says what the limit was and when it resets. If you need more for a genuine evaluation, ask — it is a conversation, not an upsell.
Why a person reads this
Approval is not automatic, and that is a deliberate choice rather than a missing feature. An account here can scan hosts, and none of the free checker's guardrails — one endpoint, port 443, an opt‑out honoured before DNS — apply to the full scanner. Letting anyone with an email address have that would make this a reconnaissance service, which is the opposite of what it is for.
So a request is recorded and waits. Expect a reply within two working days. You will get a single‑use invitation link that creates your organization when you accept it; nothing exists until then.
Scanning targets you do not own or have written permission to test is prohibited, and the same rule applies inside a trial as outside it. See the terms and the acceptable‑use policy.