InsightVM is Rapid7's vulnerability management product. It combines Rapid7 vulnerability research, Metasploit exploit knowledge, internet-wide scanning data and exposure analytics, with real-time reporting. The Security Console is the web interface where you create sites, run scans and generate reports; Scan Engines perform the scans and can be distributed across your environment, and the Insight Agent can be used with InsightVM. InsightVM is now part of Rapid7 Exposure Command, which adds attack surface management.
Rapid7 is a US company headquartered in Boston and is therefore subject to US law such as the CLOUD Act. For cloud solutions on the Insight platform, customers can choose where their data is physically stored: the United States, Canada, Europe, Japan or Australia. Rapid7 states it will not move data out of the selected region except as set out in its privacy policy or agreement. InsightVM is not open source. A European region helps with data residency, but the provider remains American.