Sharing, Vendor View and Domain Verification
Hunto builds an outside-in rating of your domains from public information. By default your organisation contributes to a shared view of that rating, so other Hunto customers (and vendor-risk users) can look up your domain's grade. You control this in Security posture, Settings.
What is shared, and what is not
Only what anyone could learn from outside leaves your organisation.
| Shared | Never shared |
|---|---|
| The domain's grade, score and whether it is provisional | Your run details, which checks you ran and who ran them |
| Each section's score, weight and state | Anything from your active checks or your own private flows and imports |
| Findings from outside-in checks that are tagged for sharing: title, severity, host, points | Your security score, settings, accepted risks and criticality |
| Counts by section and severity for sensitive areas (breach history, leaked credentials, known vulnerabilities in technology) | The details behind those counts |
| Public facts such as mail provider, country, CDN, hosting, registrar and registration date | Contacts and addresses |
| When it was rated, rounded to the hour | The organisation that produced the rating |
A rating is shared only for a root domain whose run measured at least 60% of the weight. Checks that could reveal more than the public can see are shared as counts, or not at all.
Note: what another organisation sees is the standard rating, never the security score.
Sharing and automatic rating switches
Open Security posture, then Settings, then Sharing and automatic rating. Each switch saves the moment you change it. Only an organisation admin can change them.
- Share our domains' outside-in rating with other Hunto customers and vendor-risk users: on by default.
- Rate new root domains automatically (10 credits each): on by default. See Domain rating, run rating and Rate now.
Turning sharing off removes what your runs have already shared, and hides your verified domains from everyone else's lookups. Turning it back on shares the next runs again.
Verified domains: hiding a domain from others
Turning sharing off only hides a domain if you have proved you own it. Otherwise nothing stops another organisation from rating a domain themselves. To verify a domain:
- Under Verified domains, type the domain (for example example.com) in Verify a domain.
- Select Get TXT record. Hunto shows a value to publish.
- Add a DNS TXT record on that domain with the value. Use Copy to avoid typos.
- Select Check now. DNS changes can take a few minutes. The chip changes from "Not verified yet" to "Verified
". Until then it shows "Last checked ...: not found yet." - To stop claiming a domain, select Remove.
Note: a domain you have not verified cannot be hidden.
Vendor view
Vendor view is how a domain is read for vendor-risk purposes, through the API (and tools built on it). The rating returned is the newer of two: your own most recent run of that domain, and the latest shared rating from another organisation. A shared rating arrives in a limited shape (grade, sections, tagged findings, counts, public facts, rating date) with no run and no source.
If you look up a domain from the API (POST /api/v1/ratings), a shared rating answers the request straight away, free, instead of starting a run. See Scoring through the API and MCP. If nothing has been shared, a new run starts and you pay for it.
Reading shared ratings is limited to 600 per hour for each organisation, and every read is logged.
On your own domain page, if someone else has rated your domain more recently than you, you see only the date: "A newer outside-in rating exists from
What a vendor's grade tells you (and does not)
- It reflects outside-in evidence only: DNS and email security, TLS, exposed services, web headers, reputation, breaches and lookalikes.
- It says nothing about internal controls.
- A provisional grade means too little could be checked. Ask the vendor to allow a broader check, or treat it as a starting point.
Use cases and wiring tips
- Vendor onboarding: look up the vendor's domain before the security questionnaire. Use the grade to decide how deep to go. Set your own threshold (for example, questionnaire only above B).
- Standard rating vs outsider view: your standard rating is built on the same evidence and methodology as the shared rating other customers read about you (with your own runs, not only shared ones). Use it to preview what they see, and ask the API for your domain to check.
- Keeping a domain private: verify it with the TXT record, then turn sharing off.
- Automation: gate an onboarding workflow on the API result. See Use cases and wiring tips.