Trust Centre: Security, Privacy
and Certifications
As an offensive security company, we hold ourselves to the standards we test our clients against. Here is how we protect client data and engagements, what we are certified to, and how to request the documents your security and procurement teams need.
Certifications
Independently Certified Management Systems
Our information security and quality management systems are certified to ISO/IEC 27001 and ISO 9001. Copies of our certificates are available on request.
ISO/IEC 27001
Our information security management system is certified to ISO/IEC 27001, the international standard for managing information security.
Certificate copy available on request
ISO 9001
Our quality management system is certified to ISO 9001, the international standard for quality management.
Certificate copy available on request
Our own systems
We manage our own systems under the same ISO/IEC 27001 controls, including vulnerability management, timely patching, access reviews and an incident response plan.
Engagement safeguards
Confidentiality From the First Conversation
Every engagement starts with an agreement on confidentiality and scope, and is delivered by our own team.
Mutual NDA first
We sign a mutual non-disclosure agreement before any technical details are shared.
Scope agreed in writing
Scope, rules of engagement, test windows and contacts are agreed in writing before testing starts.
Need-to-know access
Client information is shared only with the people working on the engagement, on a need-to-know basis.
Our own in-house team
Engagements are delivered by our own certified team and are not subcontracted. Everyone on them is bound by confidentiality obligations.
Safe testing
We work within the agreed scope, test windows and rate limits. Tests that could affect availability or data run only with your written approval.
Critical findings reported at once
Critical findings go to your nominated contact as soon as they are confirmed, without waiting for the final report.
Data protection
How We Handle Client Data
Where you need data to stay in a particular country or environment, we agree this in the contract and work within it.
Role-based access
Access to client data and test evidence is role-based and limited to the engagement team.
Encrypted everywhere
Client data is encrypted in transit and at rest.
Secure report delivery
Reports are delivered through secure channels, such as our iefyx platform or encrypted file transfer.
Agreed retention
Client data is kept only for the period agreed in the contract, then securely deleted. We confirm deletion on request.
Incidents, vulnerabilities and privacy
Clear Routes for Every Concern
If an incident affects client data, we notify the affected clients without undue delay and in line with our contracts and applicable law.
Report a vulnerability
Email su*****@*******er.com with “Vulnerability report” in the subject line. We acknowledge every report, keep you informed and credit you if you wish. Read our guidelines.
Privacy requests
To use your rights under the DPDP Act or the GDPR, email in**@*******er.com with “Privacy request” in the subject line. Read our Privacy Policy.
Grievance Officer
Grievance Officer, iSpyCyber Pvt. Ltd., 724, DLF Cybercity, Infocity, Patia, Bhubaneswar, Odisha 751024, India. Email in**@*******er.com.
Documents
Documents Available on Request
Security and procurement teams can request these documents before or during vendor onboarding.
- ISO/IEC 27001 certificate
- ISO 9001 certificate
- Mutual NDA
- Capability statement
- Sample VAPT report
The sample report is also available to download now.
Onboarding us as a vendor?
Tell us which documents your security or procurement team needs and we will send them.
Policies
Our Policies and Statements
Security Statement
How we protect client data and engagements, and how to report a vulnerability.
Privacy Policy
What personal data we collect, why, how long we keep it and your rights.
Cookie Policy
The cookies this website uses and how to control them.
Terms of Service
The terms that govern your use of this website.
For Procurement Teams
Company facts and the documents we provide for vendor onboarding.
Contact Us
Ask a security question or request a certificate copy.
FAQ
Trust and security questions, answered
Certifications and confidentiality
Can we see your ISO certificates?
Yes. Copies of our ISO/IEC 27001 and ISO 9001 certificates are available on request. Email in**@*******er.com or use our contact form.
Do you sign an NDA before scoping?
Yes. We sign a mutual non-disclosure agreement before any technical details are shared. Our standard mutual NDA is available on request.
Who will have access to our data?
Only the engagement team. Access to client data and test evidence is role-based, and we do not subcontract engagements.
Data handling and testing
How long do you keep our data?
Only for the period agreed in the contract. After that, client data and test evidence are securely deleted, and we confirm deletion on request.
Can our data stay in our country?
Where you need data to stay in a particular country or environment, we agree this in the contract and work within it.
What happens if you find a critical issue during testing?
We report it to your nominated contact as soon as it is confirmed, without waiting for the final report.
Still have a question? Talk to our team.