SaaS companies
An expired certificate, or a signup email that never arrives, costs revenue from the hour it happens. We warn you weeks before.
Explore
External trust monitoring
We watch your domains from the outside.
We watch your certificates, DNS and email security from outside your network, the way a mailbox provider or an attacker sees them, and tell you exactly how to fix each gap we find.
Live results in seconds. No signup, no email. Enter a public domain, like example.eu.
No agent required
First scan in seconds
Based in the EU
The trust layer
Most companies monitor their apps. Few watch how the outside world sees their domain.
A mailbox provider checks DMARC, a browser checks certificates and an auditor checks evidence. We look at your domain from all three angles and turn what we find into work your team can plan.
Email Trust
SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT and spoofing exposure.
DNS Trust
DNSSEC, nameserver health, risky records and DNS hygiene.
Certificate Trust
Expiry, issuer changes, inventory and renewal risk.
TLS Security
HTTPS configuration, protocol strength, ciphers and chain trust.
Subdomain Risk
Exposed, abandoned and takeover-prone subdomains.
Brand Protection
Lookalike domains, typosquatting and phishing infrastructure.
Registrar Monitoring
Lock status, nameserver and WHOIS changes, expiry dates.
Compliance Evidence
Exportable NIS2 / audit evidence and board-ready reports.
Cloud & internal coverage
Extend with cloud connectors and an optional internal agent.
Fix first, fix right
Each finding comes with the steps to fix it.
We turn DNS, email, certificate and TLS findings into remediation steps your team can complete.
- Plain-language explanation of every finding
- What it costs the business if left unfixed
- Exact DNS fixes with copy-paste-ready records
- One-click verification once you've applied a change
- Before / after view of the score impact
FINDING · EMAIL TRUSTHIGH
DMARC policy is p=none
Add an enforced DMARC record so spoofed mail from your domain is rejected.
DNS · TXT · _dmarc.yourdomain.com
_dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100; adkim=s; aspf=s"
Digital Trust Score before: 71After fix: 79
A number you can defend
A Trust Score, not a vanity number.
We separate what we checked from how secure you are, so a single weak control never hides behind broad coverage.
See how it is calculated01
96%
Scan coverage
How much of your domain estate we have inspected.
02
71%
Security posture
How strong the controls are across everything we inspected.
03
77
Digital Trust Score
Derived from coverage and posture, with both inputs always shown.
Proof, built in
Don't take our word for it. Verify a report yourself
Every report is digitally signed (PAdES) and carries a SHA-256 content hash. Anyone you share it with can check its integrity on our public verifier, no account needed.
The act layer
From detection to revocation, fully evidenced.
An alert on its own fixes nothing. When a certificate we manage has to go, your agent installs the replacement first and only then revokes the old one. Each step is written to an evidence ledger, chained with hashes so it can't be quietly edited, which you can export and check.
outside-in detection
CT LOGS / OCSP / CRL
01
Detect
Revoked-but-still-served certificates and broken chains are flagged the moment the outside world can see them — on every plan.
On every plan, no agent neededreplace before revoke
ACME / PRIVATE KEYS STAY ON HOST
02
Replace, then revoke
For certificates we manage, the agent installs the replacement before it revokes the old certificate. That order is there so that dealing with an incident doesn't cause an outage of its own. Private keys stay on your servers.
Zero-downtime by constructionevidence ledger
SHA-256 / PAdES
03
Prove what happened
Every action goes into the evidence ledger and is signed into your reports, so an auditor can check the order in which things happened as well as the end result.
Recorded and verifiableBuilt and operated in the EU
Built by people who run production trust infrastructure
SkyQon is built and operated in the EU by engineers who run production PKI, EJBCA certificate authorities and eIDAS-aligned trust services for a living. The scoring rules, the evidence formats and the fixes come from that operational practice.
32
EU & EEA trust-list territories tracked
5,000+
qualified trust services verified against the official lists
< 3 min
to your first scored report
30 d
advance warning before certificates expire
For every team that owns a domain
Each team worries about something different
Each of them gets what matters to them from the same view, without yet another dashboard to look after.
MSPs & IT providers
Watch every client domain from one account and hand each client a report with their name on it.
ExploreSecurity teams
Your EDR does not read DNS zones. Spoofing and takeover risk live in that blind spot.
ExploreCompliance teams
NIS2 Article 21 asks you to show working controls. Export the evidence, signed and reproducible.
ExploreAgencies
When a client's certificate lapses, the call comes to you anyway. Better to hear about it from us first.
ExploreExecutives
Know your score before the auditor or the enterprise buyer asks for it.
Run a free check
Design partner program
Ten design-partner seats for Benelux teams
The Digital Trust Center is live and self-serve. The design-partner program is something extra: direct time with the engineers who build it and early input on the roadmap, in exchange for honest feedback. If you operate domains that matter, we would like to hear from you.
Questions, answered
Questions we often get
No jargon, no mystery scoring, no compliance theatre. Just the information your team needs to act.
Still have a question? Talk to usWhat does the Digital Trust Center do?
It continuously monitors your domain trust posture: email authentication (SPF, DKIM, DMARC), DNS security, TLS and certificates, attack surface, compliance evidence and post-quantum readiness.
Do I need to install anything?
No. Monitoring is agent-less by default and runs from the cloud. The inline scan shows live results in seconds, and your first full monitoring scan completes within minutes of adding a domain. For deeper reach, optional cloud connectors and an internal agent are available on higher tiers.
Who is it for?
Businesses that own public domains: SaaS companies, security and compliance teams, MSPs and agencies — any team where a lapsed certificate or a spoofed email becomes an incident.
Is there a free option?
Yes. The Free plan monitors up to 5 domains continuously at no cost and gives you a unified Trust Score with your top findings. No payment details needed to start. Every new account also begins with 14 days of Pro included; after that it moves to Free automatically, with nothing charged.
How is pricing structured?
Plans are monthly or annual subscriptions billed in EUR or USD, from Free at €0 to Growth at €599/mo. Enterprise is priced for your environment. The pricing page lists what each tier includes.
Start with the outside
Run the first scan now.
You get a scored report in under three minutes. There is nothing to install, and we're based in the European Union.