Print this page, fill it in by hand, and sign it. Send a scan or photo of the signed page to [return address not set yet]. We set up your account from it.
EpochCore · Q-Shield
Scan consent
The company named below lets EpochCore scan the hosts listed below with Q-Shield, as this page describes.
What the scan does
Scans run from EpochCore's scan server, only when someone signed in to the company's account starts one, or once a week for hosts in a weekly check someone in the account turned on. For each host and port:
- TLS (443, or any other port): up to four short connections. Three each send a TLS hello and hang up after the server's first reply, without setting up a session. They show which key exchange the server would pick, whether it accepts the post-quantum hybrid key exchange X25519MLKEM768 offered alone, and whether it accepts the CNSA 2.0 key exchanges SecP384r1MLKEM1024 or MLKEM1024 offered alone. The fourth completes a TLS handshake to read the certificate, then closes without sending a request.
- HTTPS (443): one more connection sends one plain request for the front page (/), reads the software and version the response headers announce, and closes: no other path, no redirect followed, nothing read beyond the headers. A version on CISA's Known Exploited Vulnerabilities list fails on every profile.
- SMTP, IMAP, POP3 and PostgreSQL (ports 25 and 587, 143, 110, 5432): the same connections, each after asking the server to switch to TLS.
- SSH (22): one connection. We exchange version lines, read the server's list of key exchanges and hang up before any key is exchanged.
One host and port at a time, one connection at a time. No login, and nothing read beyond those headers. Each connection attempt and each wait for a reply gives up after 5 seconds. A server that doesn't answer is recorded as unknown, never as safe. Hosts on the opt-out list are skipped.
Withdrawing a host
The company can withdraw any host at any time by telling EpochCore which one. When EpochCore gets the message, it takes the host off the company's list, and from then on Q-Shield doesn't scan it: a scan waiting to run doesn't run, a scan already running skips it, and a weekly check that includes it stops. EpochCore keeps a record of every approval and every withdrawal.
Hosts on EpochCore's opt-out list are skipped, even when they are listed here.
Signed for the company
I can approve scans of these hosts for the company.