Privacy Policy

1. Information We Collect

When you engage our penetration testing services, we may collect the following information:

• --Contact information: Name, email address, company name
• --Application details: URLs, staging credentials, API documentation, repository access (provided by you)
• --Scan data: Vulnerability findings, network configurations, application responses, and security assessment results gathered during testing
• --Payment information: Processed securely through our payment provider; we do not store credit card details
• --Communication records: Emails and messages exchanged during the engagement

2. How We Use Your Information

We use collected information exclusively for:

• --Performing the penetration testing services you requested
• --Generating your security assessment report
• --Communicating findings and remediation recommendations
• --Processing payments for our services
• --Improving our testing methodologies (using anonymized, aggregated data only)

3. Non-Disclosure Agreement (NDA)

All engagements are covered by a Non-Disclosure Agreement. We are contractually bound to:

• --Keep all findings, vulnerabilities, and client data strictly confidential
• --Never share, sell, or disclose your information to third parties
• --Never publish or reference your company or findings without explicit written consent
• --Restrict access to your data to only the security researchers directly involved in your engagement

4. Data Retention and Deletion

We follow a strict data lifecycle policy:

• --Scan data and vulnerability findings are permanently deleted within 30 days of report delivery
• --Staging credentials and access tokens are revoked and deleted immediately after testing concludes
• --Your final report is retained for 30 days to allow for follow-up questions, then deleted unless you request an extension
• --Payment records are retained as required by applicable tax and accounting regulations
• --You may request immediate deletion of all your data at any time by contacting us

5. GDPR and CCPA Compliance

We respect your privacy rights under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). You have the right to:

• --Access: Request a copy of all personal data we hold about you
• --Rectification: Request correction of inaccurate personal data
• --Erasure: Request deletion of your personal data ("right to be forgotten")
• --Portability: Receive your data in a structured, machine-readable format
• --Object: Object to processing of your personal data
• --Opt-out of sale: We never sell personal data, but you may formally request confirmation

6. Security of Your Data

We practice what we preach. Your data is protected by:

• --End-to-end encryption for all communications and file transfers
• --Encrypted storage for all engagement data at rest
• --Access controls limiting data to authorized researchers only
• --Secure deletion procedures that overwrite data, not just remove references
• --Regular security audits of our own infrastructure

7. Cookies and Tracking

Our website uses minimal, essential cookies. We do not use third-party advertising trackers or sell browsing data. We may use anonymous analytics to understand page traffic and improve our services.

8. Third-Party Services

We use a limited number of third-party services to operate our business:

• --Payment processors for secure transaction handling
• --Email services for engagement communications

We do not share your vulnerability data or scan results with any third party.

9. Children's Privacy

Our services are intended for businesses and individuals aged 18 and older. We do not knowingly collect information from children under 18.

10. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated revision date. For active engagements, we will notify you of any material changes via email.