Trust

Security and trust

We ask clients to take security seriously, so here is exactly how we handle the data you hand us. Everything on this page describes how the platform works today. We do not claim certifications or audits we have not completed.

Where your data lives

Hosting and data storage are in the United States.
Every page and request is served over HTTPS. Data is encrypted in transit and encrypted at rest by our hosting platform.
Each client's records are isolated at the database level, so one client's data is not readable by another.

Payments

Card payments are handled entirely by Stripe. Card numbers never reach our systems and we never store them.
Invoices and receipts are issued through Stripe under our account.

Files and documents

Evidence files, signed documents, and reports are held in private storage that is not publicly reachable.
Access happens through short-lived signed links generated for a specific, authorised person.

Who can see what

Staff access is role based: owner, analyst, technician, and viewer roles each have separate permissions.
Administrative actions are written to an audit log.
Client portal accounts see only their own organisation's sessions, invoices, reports, and network map.

How we keep the platform current

Dependencies are scanned automatically for known vulnerabilities, and a critical finding blocks a release from going out.
An automated security review runs daily and alerts our internal team.
External scans we run for clients read only publicly published information and require written authorisation from someone who can give it.

Report a vulnerability

If you believe you have found a security issue in this site or our client portal, email cyberdefensedesk@protonmail.com with the steps to reproduce it. We aim to acknowledge reports within two Arizona business days. Please do not run automated testing against accounts that are not yours.