Information handling
Collect less. Restrict access. Define deletion.
DarkWater’s public website accepts only high-level scoping information. Sensitive identifiers and findings are exchanged only after authorization through an agreed protected method.
Handling standard
How DarkWater protects information throughout an engagement.
Data minimization
Only the identifiers and business context required for the written scope are collected.
Protected intake
Client-controlled workspaces are preferred for enterprise clients. Invitation-only protected workflows may be used for smaller clients.
Named recipients
Reports and priority findings are delivered only to contacts defined in the engagement.
Retention and destruction
Retention periods and closure procedures are documented before sensitive collection begins.
Never requested for the standard service
Passwords, MFA codes, recovery codes, session tokens, seed phrases, personal-account access, personal-device agents, private messages, or remote device access.