Every certificate issued for your domain — before someone else finds it.
Every TLS certificate issued by a public CA is logged to Certificate Transparency inside seconds. We watch those logs for every subdomain under your apex and email you the moment a new cert appears — whether it’s a forgotten staging box, an unapproved vendor deployment, or a lookalike typosquat someone just moved off the shelf.
Three questions the CT log answers that nothing else does.
Every certificate issued for a hostname under your domain is logged publicly by the CA to Certificate Transparency logs. That includes staging boxes, forgotten vendor subdomains, marketing-team Vercel deploys, engineer-of-the-month side projects. By the time the subdomain shows up in a quarterly asset-inventory review, it has been scanned, probed, and often indexed for months. The alert gets you to it inside a week.
CT logs also carry certs issued for every lookalike domain anyone registered — paypa1.com, acme-support-portal.io, the exact-string impersonation of your brand on a new TLD. If a cert appears, it means an attacker is one HTTPS deploy away from going live. Catching it at cert-issue time is the earliest signal that exists.
DORA Article 24(2) and NIS2 Article 21(2)(f) both expect financial-entity and essential-sector operators to maintain an inventory of information assets and detect unauthorised changes. A CT-log watcher is one of the few primitives that lets a small security team meet that bar without a full ASM platform.
Six moving parts. No agents, no DNS changes.
Tell us the apex domain you want watched (e.g. acme.com). By default, every subdomain under that apex is included — exact-match-only is available on request for teams that only care about the root hostname.
Pick how often we poll Certificate Transparency logs for your domain tree — hourly, daily, or weekly. Daily is the sweet spot for most teams; hourly is for brands that have been typo-squatted before and need lead time; weekly suits assets with low change velocity.
Each run compares the current cert set against the previous snapshot. A certificate is only alerted on once, the first time it appears. Re-issues for the same (SAN set, issuer, not-before) tuple are deduplicated so a cron-driven renewal does not spam the mailbox.
Every new cert triggers an email to the address on file. Each alert carries the full SAN list, the issuer CN, the not-before / not-after timestamps, the serial number, and a direct link to the crt.sh record. If you spot something you did not deploy yourself — a staging box, a vendor asset, a lookalike — you have the raw evidence in one click.
A read-only dashboard for your subscription shows the running inventory of every cert seen for your domain, with a search / filter / export view. Useful for quarterly audits and for handing a snapshot to an incoming vCISO or an insurance questionnaire.
Pause monitoring any time from the dashboard (snapshot history preserved). Cancel from Stripe and the subscription ends at the current period boundary — your cert history stays accessible for the retention window you paid for.
Three cadences. One domain per subscription.
Polled every 7 days. Right for low-velocity domain trees (one marketing site, a handful of subdomains).
Start →Polled every 24 hours. Right for most teams — daily is the standard cadence for CT-log alerting across the industry.
Start →Polled every hour. Right for brands that have been typo-squatted or for regulated entities with a tight detection SLA.
Start →Multi-domain, Slack webhooks, SAML/SSO?
Bundles for large domain estates, Slack / Teams / PagerDuty alert routing, and dashboard SSO are available on request.
Talk to us →