Written authorisation
Testing begins only after a signed scope and rules of engagement, with named deconfliction contacts on both sides.
Security
How we hold ourselves to account
These are our own commitments as a service provider. They are statements of practice, not third-party certifications - we will not claim an audit we have not completed.
Owner-authored commitments
Engagement safeguards
Least data collected
We request the minimum access an engagement requires, and prefer read-only or time-boxed credentials.
Encryption in transit and at rest
Engagement artefacts are encrypted in transit and at rest on our side for the agreed retention period.
Scheduled deletion
Evidence and reports are deleted on the retention schedule agreed in your contract unless a legal hold applies.
Segregated engagements
Client materials are kept separated; access is limited to the assigned engagement team.
No public naming
We never name a client or publish identifying case detail without written permission.
Data handling summary
| Category | Example | Handling |
|---|---|---|
| Engagement scope data | Asset lists, IP ranges | Retained for the contract term, then deleted |
| Evidence artefacts | Screenshots, memory images | Encrypted at rest, access-controlled, deleted on schedule |
| Reports | Findings register, executive summary | Retained per contract; you receive the master copy |
| Website enquiries | Email you send us | Held in our mailbox only; this site stores nothing |
Coordinated vulnerability disclosure
If you believe you have found a vulnerability in this website or in a service we operate, please tell us before disclosing it publicly. Include enough detail to reproduce the issue, and give us a reasonable window to remediate.
- · Do not access, modify or exfiltrate data that is not yours
- · Do not run denial-of-service or high-volume automated testing
- · Do not use social engineering against our staff or suppliers
- · We acknowledge reports and keep you updated until resolution
Machine-readable contact details are published at /.well-known/security.txt. Encryption key placeholder is on the contact page.
Report a vulnerability