Formal.ai looks like a legitimate B2B security software company that has been around for years. Its security setup is solid, it has proper legal pages, and its domain history is clean. The main thing keeping this from a higher score is that no named company or team members are publicly linked to the domain — which matters for a business selling enterprise infrastructure access.
Cross-referenced 45 live signals from Google Safe Browsing, VirusTotal, WHOIS and more on Oct 28, 2026.How we score →
Where the score comes from
We look at six areas. Here's how formal.ai did in each.
70
Security
The site has a valid TLS certificate issued by Google Trust Services, uses modern encryption, and sets browser protections against clickjacking. Basic security headers are present. The domain isn't flagged by Google Web Risk or listed on DNS blacklists, which is reassuring. A small gap: no protective DNS blocklists have reason to know about it yet, but that's not unusual.
70
Identity
The domain is 8 years old, registered through Cloudflare, and the registrant is privacy-protected — standard since GDPR and not a red flag. The site brands itself as 'Formal' and the domain name matches that. There's no named company or verified certificate identity visible, but for a business that sells network security software to enterprises, some owner identity is expected. The age and consistent branding help, but the lack of a publicly named entity behind the site keeps this score solid rather than strong.
75
Reputation
The site has been in the Wayback Machine since 2020, showing six years of consistent presence. No blacklist hits. It has a handful of Hacker News mentions in 2026, which is light but not concerning. The Tranco rank is zero — it's not a high-traffic site — but that's normal for a niche B2B security tool. Overall, there are no negative reputation signals and reasonable longevity.
75
Transparency
The site has a clear About page, contact email on its own domain, and a link to contact info. It openly describes its product and team. There are no social media links visible on the homepage, which is a minor gap for a modern SaaS company — but the product page and blog suggest an active business. The site communicates what it does clearly.
80
Compliance
Privacy policy and terms of service are present. The site doesn't collect payments or handle sensitive personal data directly from consumers — it sells B2B infrastructure software. An EU-style legal entity disclosure isn't present, but the site appears US-focused and the legal pages it does have are appropriate for its industry.
80
Infrastructure
DNS resolves to Cloudflare's CDN, which is a solid choice. Email authentication (SPF and DMARC) is configured with quarantine enforcement, protecting against spoofing. DNSSEC isn't enabled, which is a missed opportunity but not alarming for a business site. The site loads fast, has a sitemap, and uses structured data properly. Infrastructure is well managed.
What we checked
The 45 signals behind this report.
Security & Transport
Certificate Issuer: Neutral
Google Trust Services
Certificate issued by Google Trust Services
Clickjacking Protection: Good
Present
X-Frame-Options: DENY
Google Web Risk: Good
Clean
No threats detected by Google Web Risk
Protective DNS: Neutral
Not blocked
Cloudflare's malware-blocking resolver (1.1.1.2) answered normally for this domain. These resolvers refuse domains their threat intelligence lists for malware or phishing, and a scam only days old often isn't listed yet. Quad9 gave no usable answer.
SSL Certificate: Good
Valid
Valid certificate, expires in 79 days
Search Cloaking: Neutral
Not detected
Neither a visitor arriving from a Google search nor Google's crawler was sent elsewhere or shown spam that a direct visit wasn't. Cloaking that checks the visitor's network address can't be seen from our server.
Security Headers: Good
3 of 6
Site sets multiple security response headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy
Server: Neutral
cloudflare
Web server: cloudflare
TLS Version: Good
TLS 1.3
Connection uses TLS 1.3
Identity & WHOIS
About Page: Good
Found
Site publishes an About / Team / Company page — a transparency signal that the operator is willing to describe who runs the business.
Branding: Good
Complete
Site has custom branding and social media metadata
Business Disclosure: Neutral
Not found
No dedicated legal-entity disclosure page detected — common and expected outside the EU, but required for commercial sites in Germany, France, Spain, Italy, and other EU jurisdictions.
Contact Info: Good
Found
Homepage has a contact page link and an email address on the site's own domain
Domain Age: Good
8 years, 7 months
Domain created 2018-03-25 (8 years, 7 months ago)
Domain Expiry: Neutral
2030-03-25
Expires in 1244 days
Legal Pages: Good
Privacy & Terms found
Website has both privacy policy and terms of service pages
Locale: Neutral
Points to US
Business markup gives an address in US. Page language en. Hosting network registered in US.
Registrant: Neutral
Privacy protected
The registration shows a privacy service or redaction notice in place of the owner. Most registrars do this by default since GDPR (2018), for companies as well as individuals, so it hides nothing unusual.
Registrar: Neutral
Cloudflare, Inc
Registered through Cloudflare, Inc
Infrastructure & DNS
CDN: Good
Cloudflare
Site is served behind Cloudflare — indicates real operational investment in edge infrastructure
DMARC Record: Good
p=quarantine
Domain enforces DMARC — unauthenticated mail is quarantined
DNS Blacklists: Neutral
Clean
Not listed by SpamCop and Barracuda, the blacklists that answered
DNS Resolution: Good
6 IP(s)
Resolves to: 2606:4700:20::ac43:45a5, 2606:4700:20::681a:c9c, 2606:4700:20::681a:d9c, 104.26.13.156, 172.67.69.165, 104.26.12.156
DNSSEC: Neutral
Not enabled
Domain is not signed with DNSSEC
DNSSEC: Neutral
unsigned
DNSSEC status from WHOIS
Email (MX Records): Good
1 record(s)
Mail servers: smtp.google.com.
Hosting Network (ASN): Neutral
AS13335 CLOUDFLARENET
Hosted on: AS13335 CLOUDFLARENET (US)
Name Servers: Neutral
2 server(s)
DNS providers: melissa.ns.cloudflare.com., salvador.ns.cloudflare.com.
Page Load Time: Neutral
133ms
Fast page load, timed once from our server in Europe including the DNS lookup, connection setup and any redirects
SPF Record: Good
Present
Domain has SPF email authentication configured
Reputation & Reach
Hacker News: Neutral
4 stories since 2026
Hacker News readers only upvoted links to this site in 2026, and one burst of attention says less than interest over the years. The most upvoted, "fork() Considered Harmful in macOS" (2026), got 32 points.
Open Graph Type: Neutral
website
og:type declared as website
Page Description: Neutral
Control every packet your AI agents send. Formal unifies PAM, SASE, LLM gateway, and MCP gateway into one stack that enf...
Control every packet your AI agents send. Formal unifies PAM, SASE, LLM gateway, and MCP gateway into one stack that enforces least privilege inline.
Page Heading: Neutral
Least privilege for agents and humans
Page Language: Neutral
en
HTML declares lang="en"
Page Title: Neutral
Formal - Network security for the agentic era
Schema Description: Neutral
Control every packet your AI agents send. Formal unifies PAM, SASE, LLM gateway, and MCP gateway into one stack that enf...
Control every packet your AI agents send. Formal unifies PAM, SASE, LLM gateway, and MCP gateway into one stack that enforces least privilege inline.
Schema Name: Neutral
Formal
Sitemap: Good
31 pages
Site maintains a proper sitemap with 31 indexed pages
Social Media Presence: Neutral
None found
No social media links found on homepage
Structured Data: Good
Found
Site uses structured data identifying itself as: Organization, WebSite
Tranco Rank: Neutral
Not ranked
This site is not in the top 1 million most visited websites — this is normal for small or new businesses
Web Archive History: Good
6 years
Earliest archive snapshot from 20200921
Website Status: Good
Online
Website is live and responding
robots.txt: Good
Present
robots.txt has 3 directives and references a sitemap
Run this site? Show your score.
Add a trust badge so visitors can see your live score for themselves.
Formal.ai sells network security software aimed at companies that need to control what AI agents and human employees can access. It claims to secure over a million requests per second for clients like Cursor, a popular AI coding tool. Based on our investigation, the site has been operating since 2018, uses strong encryption, and publishes both a privacy policy and terms of service. The domain is hosted on Cloudflare and has no history of malware or phishing flags.
For a business selling enterprise security tools, it's standard to see a named company and leadership team publicly associated with the domain. Formal.ai has an About page and a blog, but the registrant information is privacy-shielded, and there's no obvious parent company name on the homepage. That's not a dealbreaker — many B2B startups operate this way — but it's something to note if you're evaluating them as a vendor.
There are no signs this is a scam or fake operation. The Wayback Machine shows a consistent web presence since 2020, and the product descriptions are detailed and technically specific. If you're considering formal.ai for your organization, the next step would be to ask for customer references or case studies beyond what's on their site. The signal record doesn't suggest risk — it suggests an established but lightly branded company that could benefit from more transparency.