For enterprise
Client-side security that passes the security review.
CentralCSP watches the Content Security Policy, scripts and browser reports of every site you run. EU-hosted, with SSO, RBAC and an audit log. When the questionnaire lands, we answer it with you.
Data residency in the EU
France, on OVH
Annual pentest
Public report
Status page
status.centralcsp.com
Enterprise controls
SSO, RBAC, audit log
The vendor assessment
Your questionnaire, answered before you send it.
These rows are on every security review spreadsheet we have seen. Here is where CentralCSP stands on each one, evidence linked.
| Requirement | Our answer | Status |
|---|---|---|
| Single sign-on | SSO login ships with the Enterprise plan, so your team signs in through your identity provider. Request SSO setup | Answered |
| Role-based access | Scope each member to the sites and permissions they need. Juniors see their projects, not the whole estate. | Answered |
| Audit log | Account activity is logged. Who changed what, and when, stays answerable. | Answered |
| Data residency | Hosted in France, on OVH. Report data never leaves the EU, so there are no transfer clauses to negotiate. | Answered |
| Penetration testing | An independent pentest, every year. We publish the report. Read the 2026 report | Answered |
| Availability | Uptime and incidents are public, and an SLA is available as an Enterprise plan option. status.centralcsp.com | Answered |
| Support | Priority support on the Enterprise plan, answered by the engineers who build the platform. | Answered |
| Scale | The platform already ingests billions of browser reports. Your portfolio will not be what stresses it. | Answered |
| Paperwork | The DPA is public and ready for legal review. Send us the rest and we fill it in with you. Read the DPA | Answered |
Trusted by teams across the world
Integrations
Integrates into the systems you already run.
CentralCSP is not another silo. Reports, scores and evidence flow out over the REST API, webhooks and MCP, straight into the tooling you already run.
- Full REST API with scoped tokens
- Built-in MCP server for AI agents
- Webhooks and CSV exports
Sign in through your identity provider.
SSO login ships with the Enterprise plan and we set it up with you during onboarding. Joiners and leavers are handled where you already manage them, and every sign-in lands in the audit log.
- SSO login on the Enterprise plan
- Set up with you during onboarding
- Sign-ins recorded in the audit log
One workspace. Scoped access.
Invite the whole security and platform team, no shared logins. Each member gets a role that scopes what they can view, configure or enforce, per site.
- Invite your team, no shared logins
- Roles scoped per member and per site
- No all-or-nothing admin access
Every account action, on the record.
Sign-ins, role changes, policy edits: the audit log records who did what, and when. When the review asks how access is controlled, the answer is one screen away.
- Audit log of account activity
- Actor and timestamp on every event
- Evidence for access reviews
'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20offset='0'%20style='stop-color:%235a62c3'/%3e%3cstop%20offset='.5'%20style='stop-color:%234d55bd'/%3e%3cstop%20offset='1'%20style='stop-color:%233940ab'/%3e%3c/linearGradient%3e%3cpath%20d='M21.8%20125h218.3c12.1%200%2021.8%209.8%2021.8%2021.8v218.3c0%2012.1-9.8%2021.8-21.8%2021.8H21.8C9.8%20387%200%20377.2%200%20365.2V146.8c0-12%209.8-21.8%2021.8-21.8'%20style='fill:url(%23microsoft-teams_svg__SVGID_1_)'/%3e%3cpath%20d='M188.4%20208.1h-43.6v118.8H117V208.1H73.5V185h114.9z'%20style='fill:%23fff'/%3e%3c/svg%3e)
'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20offset='0'%20style='stop-color:%231d93d2'/%3e%3cstop%20offset='1'%20style='stop-color:%2338b0e3'/%3e%3c/linearGradient%3e%3ccircle%20cx='256'%20cy='256'%20r='256'%20style='fill:url(%23telegram_svg__a)'/%3e%3cpath%20d='m173.3%20274.7%2030.4%2084.1s3.8%207.9%207.9%207.9%2064.5-62.9%2064.5-62.9l67.3-129.9-169%2079.1z'%20style='fill:%23c8daea'/%3e%3cpath%20d='m213.6%20296.3-5.8%2062s-2.4%2019%2016.5%200c19-19%2037.2-33.6%2037.2-33.6'%20style='fill:%23a9c6d8'/%3e%3cpath%20d='m173.8%20277.7-62.5-20.4s-7.5-3-5.1-9.9c.5-1.4%201.5-2.6%204.5-4.7C124.6%20233.1%20367%20146%20367%20146s6.8-2.3%2010.9-.8c2%20.6%203.6%202.3%204%204.4.4%201.8.6%203.7.5%205.5%200%201.6-.2%203.1-.4%205.4-1.5%2023.8-45.7%20201.6-45.7%20201.6s-2.6%2010.4-12.1%2010.8c-4.7.2-9.3-1.6-12.6-4.9-18.6-16-82.8-59.2-97-68.6-.6-.4-1.1-1.1-1.2-1.9-.2-1%20.9-2.2.9-2.2s111.8-99.4%20114.8-109.8c.2-.8-.6-1.2-1.8-.9-7.4%202.7-136.2%2084.1-150.4%2093-.9.2-2%20.3-3.1.1'%20style='fill:%23fff'/%3e%3c/svg%3e)
Alerts where your teams already work.
Route each site's incidents to the channel that owns it. New script on the checkout? The payments squad's channel pings. No new inbox to watch.
- Alerts to Slack, Teams, Google Chat, Telegram or email
- Webhooks for anything custom
- Channels scoped per site and per team
Compliance paperwork
Send us the questionnaire.
Security questionnaires, DPAs and vendor forms are part of buying software. We treat answering them as part of selling it.
01 - Send
Forward the paperwork.
The questionnaire, the vendor form, your DPA template. Whatever procurement handed you, pass it on.
02 - Answer
We fill it in with you.
Hosting, controls, data handling: we draft the answers, you review, we refine until your security team has what it needs.
03 - Sign
Close the review, start monitoring.
DPA signed, assessment filed. Your team gets back to watching what actually runs in your users' browsers.
Get started now, deploy tomorrow.
An adjusted quote on custom quotas, plus the controls above, enabled for your workspace. Tell us the size of your estate and we come back with numbers.
Talk to sales- Custom quotas, adjusted pricing
- SSO and role-based access
- Audit log
- Optional SLA
- Priority support
- Data residency in the EU
FAQ
Frequently asked questions
What security reviews ask us most, answered.
Start the review with the answers in hand.
Talk to sales for an adjusted quote, the DPA and the pentest report. Pilot on one site while procurement runs its process.