Is angel.co safe to use as a vendor?

angel.co scored 89/100 on LynxRadar's security posture assessment. The domain meets baseline security requirements. 8 checks passed, 1 warnings, 1 critical issues across 10 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

What TLS version does angel.co use?

angel.co uses TLSv1.3 with TLS_AES_256_GCM_SHA384. TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Does angel.co have DMARC configured?

Yes. angel.co's DMARC policy is set to 'reject'. SPF record: yes. Strengths: DMARC policy set to reject (strongest); DMARC pct=100 — policy applies to all mail; Aggregate reports (rua) configured; SPF hard-fail (-all) configured; SPF DNS lookup count: 1/10 (within limit); DKIM configured (selectors: google).

Does angel.co have SPF configured?

Yes. SPF record: v=spf1 include:_spf.google.com -all

Does angel.co have security headers configured?

angel.co has 4 of 5 recommended security headers. Present: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy. Missing: Permissions-Policy.

Has angel.co been involved in a data breach?

No known breaches found. No known breaches found in public disclosure databases.

Does angel.co have known CVE vulnerabilities?

Detected technologies: cloudflare. (cloudflare detected but excluded from CVE matching — upstream infrastructure). All detected technologies are upstream CDN/proxy infrastructure. No application-level software versions exposed.

Is angel.co's SSL certificate valid?

Yes. Strengths: Certificate valid, 79 days remaining; Issued by Let's Encrypt. Note: Wildcard certificate in use (*.domain) — covers all subdomains. Common practice; worth noting that compromise would affect all subdomains.

angel.co Security Report — Grade B+ (89/100)

Q: Does angel.co use HSTS?

No. Strict-Transport-Security header is missing. Connections can be downgraded to HTTP via man-in-the-middle attacks.

Q: Does angel.co have DNSSEC enabled?

No. Strengths: 2 nameservers configured (nick.ns.cloudflare.com., amber.ns.cloudflare.com.); 5 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.

B+

Trust rating

Good · 89/100

Procurement snapshot

0 critical findings identified — these point to architectural gaps, not just configuration tweaks.

Strengths

Known Breaches

TLS Configuration

DMARC / Email Security

MX Records & Mail Provider

Questions to ask

Confirm DNSSEC rollout timeline

Estimated remediation effort: 1–3 days

Based on a passive external scan — supplement with vendor-provided attestations, not a replacement.

Trust Score Trend

→ No change 1 scan · Last scanned February 18, 2026

Your rating Industry average

Score

100 75 50 25 0

B+

angel.co

89/100

Compliance & Certifications

Not yet verified

SOC 2 Type II

Audit report not on file

3rd party · AICPA

ISO 27001

Certificate not on file

3rd party · accredited body

GDPR

DPA not on file

Self-reported

Incident History

No public breaches on record

Security Posture

2 items need attention

8 passed

Turn on HSTS (forces browsers to always use HTTPS)

HSTS Header

< 1 hour High

This puts visitor logins and session data at risk of interception on untrusted networks. angel.co doesn't send the HSTS header, so a browser can still be tricked into connecting over plain, unencrypted HTTP instead of HTTPS — an attacker on the same network (e.g. public wifi) can exploit that gap to intercept traffic. Turning HSTS on tells every browser "always use HTTPS for this site, no exceptions."

PCI-DSS 4.0Req 6.4.1

Required application security controls

NIST 800-53SC-8

Transmission confidentiality and integrity

How to fix this

1Add this response header to your site. You're using Cloudflare in front of this site — add it there, see https://developers.cloudflare.com/rules/transform/response-header-modification/create-dashboard/.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

2Before adding it, make sure every subdomain (not just the main site) also works over HTTPS — HSTS applies site-wide.

3Confirm it's live: search "http header checker" and enter angel.co.

4Once confirmed, submit the domain at hstspreload.org so browsers enforce HTTPS even on a user's very first visit.

HSTS guide

Report unlocked.

View all 8 passed checks

Known Breaches

TLS Configuration

DMARC / Email Security

MX Records & Mail Provider

Security Headers

CVE Exposure

Certificate Hygiene

Subprocessors & Tech Stack

Company Signals

Operational risk

Last funding

Employees

Trust Resources

Claim profile →

Trust Center

Not detected

DPA (Data Processing Agreement)

Subprocessors List

Tech Stack Detected

Subprocessors

Cloudflare

Similar companies in B2B SaaS / Software

Appears in

B2B SaaS / Software vendors

770 companies scanned by LynxRadar

Vendors graded B

794 companies · LynxRadar ranking

Blocking Issues

Not enabled

Strict-Transport-Security header is missing. Connections can be downgraded to HTTP via man-in-the-middle attacks.

Likelihood: ★★★☆☆

Impact: ★★★★☆

Medium Priority

Not enabled

Strengths: 2 nameservers configured (nick.ns.cloudflare.com., amber.ns.cloudflare.com.); 5 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.

Likelihood: ★★☆☆☆

Impact: ★★★☆☆