Information handling
How your information is handled
Start with a brief description through the website. Sensitive identifiers and findings are exchanged after authorization, using an agreed protected method.
Handling standard
How information is collected, delivered and retained.
Collect only what is needed
Only the identifiers, records and context required for the written scope are collected.
Agree on secure transfer
Client-controlled workspaces are preferred for enterprise clients. Invitation-only protected workflows may be used for smaller clients.
Limit who receives the work
Reports and priority findings are delivered only to contacts defined in the engagement.
Define retention and deletion
Retention periods and closure procedures are documented before sensitive collection begins.
What to keep out of the first message
Do not send private messages or sensitive evidence through texts or public forms. Standard business cyber reviews do not require private messages. For an accepted investigation, relevant messages you are authorized to share may be reviewed through the agreed protected channel.
Passwords, MFA codes, recovery codes, session tokens, seed phrases, personal-account access, personal-device agents and remote device access are not requested for these services.