Access is invite-only. Accounts are created by a Kloof operator — there is no public sign-up.
Kloof is not a penetration test, and not a SOC 2, HIPAA, or ISO certification. It produces dated evidence.