GuardScope runs all six layers in parallel — you get a complete intelligence report in under 8 seconds.
Get Early Access — FreeA reasoning AI writes a full chain-of-thought before reaching its verdict. It detects urgency manipulation, impersonation, social engineering, and psychological pressure tactics. Temperature locked to 0 for 100% deterministic results.
All three email authentication protocols verified against Cloudflare DNS over HTTPS. A 20-selector DKIM probe catches misconfigured selectors that basic tools miss. Results framed with full semantic accuracy.
Every URL in the email is extracted — including plain-text URLs not in anchor tags — and checked against five threat intelligence databases simultaneously. Results arrive in seconds, not minutes.
Attackers register lookalike domains days or hours before a campaign. RDAP protocol lookup reveals registration date, registrar, and risk classification — catching brand-new threat infrastructure that reputation databases haven't catalogued yet.
200+ brand list and 45 executive authority patterns catch Business Email Compromise — CFO wire transfer requests, fake lawyer threats, government impersonation, and C-suite fraud. Combined with freeProvider detection to catch Gmail-based BEC.
The engine is specifically calibrated for the African threat landscape — EFCC/CBN fraud patterns, BVN phishing, advance-fee 419 scams, and Nigerian fintech impersonation attacks. Plus NDPR 2023 and GDPR compliance built in.
Six layers of security architecture protecting both your data and the platform itself.
Email body, headers, and URLs are never persisted. analysis_history stores only the sender domain — never content.
All API calls go through the backend. The Chrome extension contains no API keys, tokens, or secrets of any kind.
Upstash Redis rate limiting: 10/min + 50/hr for authenticated users. 5/min + 5/day for anonymous users. Hard quotas enforced server-side.
9 regex patterns strip prompt injection attempts before any text reaches Mercury-2. XML tag wrapping adds another layer of separation.
Every authenticated endpoint validates JWT server-side. The promo validate endpoint additionally checks that JWT email matches request email.
Row-Level Security on all Supabase tables. Users can only read their own data. Tier escalation and quota manipulation vectors removed in migration 004.