Your data during a test

Before we start

• We test against staging or a dedicated test environment wherever one exists. If production is in scope, we agree in writing which actions are allowed and which are not.
• You create the test accounts and the test data. We never ask for a real customer’s credentials.
• The scope document names the systems, the windows, the data we may read and the people to call. Anything not named is out of scope.

During the test

• We read what we need to prove a finding and no more. If a vulnerability exposes personal data, we capture the minimum that demonstrates it, redact it in the report, and tell you the same day.
• We do not download, bulk-export or keep copies of customer data. Where a finding is about scale, we prove it with a count, not a dump.
• Denial-of-service and volumetric tests run only against environments you designate for them, in the agreed window.
• Access is through named accounts you issue to us, so every action we take is in your logs under our names.

Where our evidence lives

Screenshots, requests, responses and notes are kept in an encrypted engagement folder on devices with full-disk encryption, accessible only to the people on your engagement. Reports are delivered through the channel you choose; by default an encrypted archive with the password sent separately.

When it is gone

Thirty days after the retest is signed off we delete the engagement folder and the test accounts you gave us are yours to revoke. If you want us to keep the evidence longer, for an audit for example, you tell us and we keep it for the period you name.

If something goes wrong

If we cause an incident during a test, you hear from us before you hear from your monitoring, with what happened and what we are doing about it. If we find your data somewhere it should not be, outside the engagement, we tell you and only you.