Five steps, and only the first four need you. The fifth runs on its own for as long as the site is in your portfolio.
Create an agency account in under a minute and pick the plan that matches your portfolio. We provision an isolated workspace scoped to your organisation through Postgres row-level security.
~1 minute · signup · email verification · workspace bootstrap
Paste a client domain and label it. Every site you maintain sits in one list, with its grade and the date it was last looked at.
~30 seconds per site · targets.insert · plan-limit check
Passive modules run immediately — they read publicly broadcast data, exactly like a browser does. To unlock the active modules, drop a DNS TXT record or an HTML file at the web root. It takes two minutes and it persists.
~2 minutes · one-time · DNS TXT or /.well-known file · stored proof of mandate
The scan is dispatched as an async job, so you keep working. When it lands you get the grade, the issues ranked by priority, and fix snippets you can paste straight into a config. Export a PDF dressed in your agency's brand — nothing about us on the page your client reads.
~2 minutes end-to-end · 8 modules · diff vs last scan · white-label export
Continuous monitoring scans every target weekly or daily and diffs each run against the previous one. You are emailed only when something new appears — a certificate about to expire, a header removed, a grade that dropped. Silence means the portfolio is still clean.
runs in background · scheduled runs · diff vs previous · throttled alerts
HTTP security headers, SSL/TLS configuration, DNS records, email authentication (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI), technology fingerprinting, subdomain enumeration from passive sources, open ports and service banners.
Yes, provided you have a mandate — a maintenance contract, a signed audit agreement, or an explicit email from the client. For active-tier scans we enforce a technical ownership check on top of that contractual mandate.
In France. Supabase eu-west-3 (Paris), backed by AWS. Customer data never transits to non-EU regions during normal operation. Stripe handles billing from Ireland, transactional email goes through Resend in the EU.
You upload your logo and a brand colour in Settings. Every generated PDF renders with your identity — no Mythos Scan logo, no Mythos Scan footer, no mention of us anywhere on the page your client reads.
A clean report is as valuable as a long one. Your client pays you for the confidence that nothing changed, and you get the same white-label PDF with an all-clear summary — your retainer justified in one artifact.
Change it whenever you want, cancel anytime from the customer portal.