Open-source vendor review
Where is the data? Who processes it? How secure is it from the outside?
Gaprism reviews a vendor’s domain from the outside and keeps the evidence behind every finding. It is open source, runs on your own server, and says plainly what it can’t see.
One email when the beta opens. You confirm your address by email first, and can unsubscribe at any time.
- Apache-2.0
- Self-hosted
- No telemetry
mail.example.com
Certificate expires soon
The TLS certificate of mail.example.com expires in 6 days.
- Observation
- notAfter 2026-11-08 12:00 UTC
- Source
- TLS handshake, port 443, SNI mail.example.com
- Observed
- 2026-11-02 09:14 UTC
- Rule
- TLS_EXPIRES_SOON
Advice
Renewal should be automated; ask how certificate expiry is monitored.
What it answers
Three questions, answered with evidence
Every vendor review starts with the same three. Gaprism answers each from what can be observed from the outside, and shows where the answer came from.
Where is the data?
Hosts come from Certificate Transparency logs, so you see the names a vendor holds certificates for, not only its website. Each address is placed by country, region and network, using a database on your own server.
- The country, region and network of every address, and who runs the network
- CDN and anycast addresses flagged, because there the location shows where the address is announced, not where the data is processed
- Nothing about the review is sent to a third party to find a location
203.0.113.10 · CH · AS64500 Example Hosting AG · ip check · 2026-11-02 09:14 UTC
Who processes it?
Gaprism reads what each host shows: its headers and cookies, the pages it loads and its DNS records. From that it names the services behind it.
- The CDN or WAF in front of a host, and the technologies behind it, with the version and where it was read
- Third parties a page loads from, and the mail platform named in the MX records
- Name server operators and the registrar
www.example.com · nginx · Cloudflare CDN and WAF · mail: Microsoft 365 · tech check · 2026-11-02 09:14 UTC
How secure is it from the outside?
Documented rules judge what the checks observed. Each finding carries a severity, a confidence, whose it is (the hostname, only the address, or shared infrastructure) and a link to its evidence.
- TLS certificates, protocol versions and cipher suites
- HTTP security headers and cookie flags
- Email authentication: SPF, DKIM, DMARC and MTA-STS
- Exposed services and their CVEs, ranked by CISA’s Known Exploited Vulnerabilities catalogue and EPSS
- Subdomain takeover, blocklists and security-DNS reputation, security.txt, DNSSEC and registration data
HSTS_MISSING · Low · http check · 2026-11-02 09:14 UTC
Examples use the reserved domain example.com and addresses from the documentation ranges.
How it works
From a domain to findings you can follow up
-
Step 1
Enter a domain
Only domains you’re allowed to assess.
-
Step 2
Gaprism finds the hosts
From Certificate Transparency logs.
-
Step 3
It checks each host
Standard, low-impact requests: DNS lookups, a few TLS handshakes and a couple of ordinary web requests per host, plus public data sources. It never logs in, scans ports or exploits anything.
-
Step 4
Rules judge what was observed
Documented rules turn observations into findings, each linked to its evidence.
-
Step 5
You decide
Accept a finding or mark it a false positive, then export CSV or JSON, or print the report.
Limits
Honest about what outside evidence can’t show
A review from the outside is evidence, not a verdict. Gaprism is built to keep that difference visible.
No score
Gaprism doesn’t rate a vendor out of 100. A single number hides the evidence; a finding keeps it.
Not checked isn’t clean
Every check ends as ok, no data, unavailable, error or skipped. A check that didn’t run is never shown as clean, and no findings is not a clean bill of health.
A finding is a question, not a verdict
It is an observation about internet-facing systems at one moment, with its limits attached. What it means for the vendor relationship is your judgement.
Open source
Open source, with a clear line
What you get
- The Apache License 2.0, with the code open to read, run and change
- Your own server: assessments and evidence stay with you
- Accounts with two-step sign-in, an audit log, CSV and JSON exports and a printable report
- A command line, and documentation for every check and rule
Source code: github.com/gaprism
What the maintainer commits to
- What ships in the open edition never moves into a paid edition
- No limits that exist to push you towards a paid edition
- No telemetry, crash reports, update checks or licence checks, and pages that load nothing from outside
- Gaprism Pro, the commercial edition, is for what a larger organisation needs and an analyst doesn’t, and a first version is part of the beta. Where a feature falls is decided by who it serves, and when in doubt it is open
Questions
Before you ask
Is it free?
Yes. The code is open source under the Apache License 2.0, and you run it yourself. Some data sources have terms of their own, for example free for non-commercial use only, so they stay off until you choose them. The documentation lists each one.
Does it assess vendors without asking them?
Gaprism sends standard, low-impact requests and asks public data sources. It never logs in, scans ports or exploits anything, and its requests name the tool in the User-Agent so site owners can see who asked. Only assess domains you’re allowed to assess.
Where does my data live?
On the server you run it on. The open edition sends no telemetry and checks no licence. The page for a new assessment lists what leaves your network for each setting, such as the domain name sent to a registry or a data source.
Who is it for?
Security analysts, GRC and third-party risk teams, and engineers who assess vendors. You should be comfortable running a Docker Compose stack, or a small Python and PostgreSQL setup.
What does the beta include?
The open-source core and a first version of Gaprism Pro, the commercial edition. The beta page says what that means.
Is there a hosted version?
There is no hosted service today. You run Gaprism yourself.
Join the beta
The first public release is in preparation. Join the list and you’ll get one email when it’s ready to try.
The beta includes the open-source core and a first version of Gaprism Pro, the commercial edition. What the beta includes
Questions first? Use the contact form.
You confirm your address by email first.