Architecture
ZoneAudit
How ZoneAudit keeps scans, findings and access codes for a domain.
ZoneAudit keeps its own records about each domain it looks at. They all hang off one Domain record, and that record shares its ID with the domain claim in the identity service.
The ZoneAudit records around one domain.
Domain
The ZoneAudit Domain is the shared directory domain. Its ID is the same domainId the identity service uses for a domain claim, so a claim in identity and a domain in ZoneAudit always mean the same domain.
- When the claim is verified, ZoneAudit records when, and which organisation holds it. Both are private and never shown through the API.
- A domain with a verified claim is scanned every week.
ScanSnapshot
One scan run of one domain.
- Fixed. Every value is set when the scan is recorded. A snapshot is never changed or removed afterwards.
- Private. Only the organisation that holds the verified claim, or a CobraSphere system account, can read it.
- Recorded versions. Each snapshot records the versions of the platform it ran on. Only production runs with every version recorded can be published.
- Cadence.
WEEKLYfor a domain with a verified claim,MONTHLYfor a domain on a research list. - Profile.
PASSIVE_DNSreads public DNS records only.PASSIVE_DNS_TLSalso makes one secure connection each to the domain and its www address to read the certificate, the same request a browser makes. It is used only for claimed domains. - Each snapshot keeps its findings, a count of findings at each level and the worst level found.
FindingState
The lasting state of one finding. A finding is one check on one domain, and it stays the same finding from scan to scan.
- Each finding gets a finding ID such as
ZA-22B29Kthe first time the domain and check are seen. It never changes, so a finding can be logged and traced. - Intentional. Someone in the business can confirm a result is as they want it, with a short reason. From the scan they were looking at onwards, the finding counts as a pass and shows as Intentional. The mark can be undone.
- Assignee. A finding can be assigned to a person in the same business.
- When two people change the same finding at once, the second is asked to reload.
- The snapshots stay as they were. The state is laid over each snapshot when it is read.
FindingEvent
One entry in a finding's history, with who and when. Entries are only ever added, never changed or deleted.
| Type | What happened |
|---|---|
MARKED_INTENTIONAL | Marked as intentional, with a reason |
INTENTIONAL_UNDONE | The intentional mark was taken off |
ASSIGNED | Assigned to a person in the business |
UNASSIGNED | The assignment was cleared |
NOTE | A note was added |
DomainPerson
A person of the business that holds a domain's verified claim, as ZoneAudit has seen them. ZoneAudit records the person when they open the domain's results or work on a finding, with their identity ID, email address and the organisation that held the claim. A finding can be assigned to the people recorded for the organisation that holds the claim now.
AccessCode
A code that opens one snapshot of one domain, the latest when the code was issued.
- A code works for 30 days by default, and for at most 90.
- Only a hash of the code is stored. The code itself is shown once, when it is issued.
- Each code is issued after an approval, and records who issued it and the approval it was issued under.
- Each code records who it is for,
LEADERSHIP,TECHNICALorBOTH, so the page can show the matching introduction. - A code can be revoked. ZoneAudit counts how often a code is used and when it was last used.
- A verified claim gives the business every later scan, without a code.
ScanListEntry
A domain on a named scan list, such as research-2026-10. Domains on a list are scanned every month. Lists are private and change only when a list is imported.