Security Statement

As an offensive security company, we hold ourselves to the standards we test our clients against. This statement summarises how we protect client data and engagements, and how to report a security vulnerability to us.

1. Certified management systems

Our information security and quality management systems are certified to ISO/IEC 27001 and ISO 9001. Copies of our certificates are available on request.

2. Confidentiality from the first conversation

• We sign a mutual non-disclosure agreement before any technical details are shared.
• Scope, rules of engagement, test windows and contacts are agreed in writing before testing starts.
• Client information is shared only with the people working on the engagement, on a need-to-know basis.

3. Our own in-house team

Engagements are delivered by our own certified team and are not subcontracted. Everyone who works on client engagements is bound by confidentiality obligations and completes regular security awareness training.

4. Protecting client data

• Access to client data and test evidence is role-based and limited to the engagement team.
• Data is encrypted in transit and at rest.
• Reports are delivered through secure channels, such as our iefyx platform or encrypted file transfer.
• Where clients need data to stay in a particular country or environment, we agree this in the contract and work within it.
• Client data and test evidence are kept only for the period agreed in the contract and are then securely deleted. We confirm deletion on request.

5. Testing safely

• We work within the agreed scope, test windows and rate limits, using test accounts and test data wherever possible.
• Critical findings are reported to the client’s nominated contact as soon as they are confirmed, without waiting for the final report.
• Tests that could affect availability or data are only performed with the client’s written approval.

6. Securing our own business

We manage our own systems under the same ISO/IEC 27001 controls, including vulnerability management, timely patching, access reviews and an incident response plan. If an incident affects client data, we notify the affected clients without undue delay and in line with our contracts and applicable law.

7. Report a vulnerability

If you believe you have found a security vulnerability in our website or systems, please email su*****@*******er.com with “Vulnerability report” in the subject line. Please include a description of the issue, the steps to reproduce it and its potential impact.

When researching, please:

• access or change no more data than you need to demonstrate the issue;
• avoid denial-of-service testing, social engineering and physical attacks;
• give us reasonable time to fix the issue before sharing it publicly.

We will acknowledge your report, keep you informed of our progress and credit you if you wish. We will not take legal action against research carried out in good faith under these guidelines.

8. Contact us

For security questions or certificate requests, email in**@*******er.com.