Frequently asked questions

An exposure management, application security posture (ASPM) and remediation orchestration platform for one organisation. It brings in findings from your scanners, code analysis tools, pentest reports and its own scan engine, folds duplicates into one finding per real problem, ranks them by real risk, routes them to the team that owns them, and closes a finding only after a rescan proves the fix.

No. FixTrail reads the tools you already run — vulnerability scanners and SAST, SCA and DAST tools — and keeps each one's original result. It also has a scan engine of its own, for scanning your web assets and for rerunning exactly the checks that found a problem once a fix is in.

Findings come in from Tenable, Qualys, SonarQube, Semgrep and other SARIF tools, GitHub Advanced Security, Snyk, Trivy, ZAP and Burp Suite. Work goes out to Jira, ServiceNow, Azure DevOps, Freshservice, ManageEngine ServiceDesk Plus, Zendesk and GitHub or GitLab issues. Notices go to email, Slack, Microsoft Teams, PagerDuty and Opsgenie, and events to Splunk and Microsoft Sentinel.

Every source is mapped to one shape and keyed by a fingerprint of what the problem is and where it lives, so the same weakness reported by four tools becomes one finding with four sources. Near-misses become a suggestion an analyst answers rather than a silent merge, and any merge can be split again, with an audit trail.

Not by severity alone. The risk score combines severity and CVSS with the likelihood of exploitation (EPSS), known exploitation (CISA KEV), how much the asset matters, whether it faces the internet, confidence and compensating controls. Every score keeps the working that produced it, so you can explain why a finding is at the top.

In your own infrastructure. It is deployed on your servers for one organisation and is not a shared, multi-tenant service. It runs as a set of containers, and scans run in isolated containers on a network that cannot reach the database.

Only where you send it. Findings, assets, tickets and evidence are stored in the database you host, and leave it only for destinations you configure yourself: your ticketing system, notification tools such as Slack, Teams, PagerDuty or Opsgenie, your SIEM or GRC platform and — if you turn on the AI features with a model provider key — the model provider. Summaries send the model only counts and titles; the pentest import sends it the report's pages to read, and masks secrets before anything is stored.

Through your own single sign-on (OIDC or SAML), or with an account your administrators invite them to — there is no self-registration. Five roles (Admin, Security Lead, Analyst, Engineer, Auditor) map to fine-grained permissions, and the API checks the permission on every request.

The interface is in English and Turkish, and each person chooses their own. Everything the platform sends out — email, Slack and Teams messages, ticket text — is in English, so a ticket reads the same to every team. Findings are shown in the language their source wrote them in.

No. AI is advisory: it suggests fixes, drafts summaries and helps with triage, but predefined rules make the decisions and a person approves every closure. A finding thought to be fixed becomes a closure proposal that somebody has to accept, and the audit log records who did.

A targeted rescan. When the ticket is done, FixTrail reruns only the checks that found the finding; if the problem is gone, it proposes closure and a person approves it. A closed ticket on its own moves the finding to awaiting verification, never to fixed.

Yes. You upload the PDF and AI reads it into targets and findings, but nothing is imported until a person has passed two gates: first confirming the scope, the assets and the project, then approving the findings themselves. Each finding keeps its evidence from the report, with secrets masked.

A finding becomes a ticket in the tool the team already uses: Jira, ServiceNow, Azure DevOps, Freshservice, ManageEngine ServiceDesk Plus, Zendesk, GitHub or GitLab. FixTrail then reads the ticket back on its own every five minutes while it is open and moves the finding when the ticket moves; it never edits a ticket after raising it. The SLA clock starts when somebody is made responsible.

As an enterprise deployment, quoted for your organisation after a conversation about your estate and the sources you run. There is no public price list.

Fill in the form at the end of the home page, or write to us. The demo takes an hour and runs against your own export rather than our sample data: we ingest it and show you what deduplicates and how the priority order changes. The form only opens your own mail app; nothing is sent until you send it.