Privacy policy

When you submit the contact form on this website, we collect the information you choose to provide: your name, work email address, company name, and optionally your phone number, area of interest, timeline, and the details of your message.

This website does not use advertising cookies or tracking pixels. We do not build advertising profiles, and we do not sell or rent personal information to anyone, ever.

We use Vercel Web Analytics to count page views so we know which pages are worth improving. It sets no cookies, does not follow you to other websites, and records only aggregate information such as the page visited, the referring site, country, and device type. It does not identify you, and we cannot use it to link a visit to a contact form submission.

If you arrive from an ad or a link with campaign tags, your browser tab notes which campaign or website sent you, and the ad's click reference if there is one. It stays in that tab and is gone when you close it. It is not a cookie. If you then build a proposal or send us a message, it goes with it, so we know which ads work. If we tell an ad network that one of its clicks became an enquiry, we send only its own click reference, never your name or email.

Our hosting provider keeps short-lived technical logs of requests to this website, such as which page was loaded and when, to keep it running and secure. We do not use them to identify you, and they are not linked to anything you submit.

When you use the free website check, we record the website you entered and the time. We do not record anything about you. The check itself only looks at public information about that website.

When you answer the proposal questions, we ask for your work email at the end, just before your price. We record it with the website, your answers, any details you add and the proposal we build. We email you a copy of your proposal, and our team is sent the same details so a tester can follow up with you about it. Your proposal link carries the website, your answers and the price, but never your email address or your notes.

If you ask us to reach out, we record your name, work email, phone number if you give one, and anything you write in the notes, and send them to our team with your proposal so a tester can contact you. We also email you what happens next. We keep these so we can follow up about that proposal. We do not add you to a newsletter or a mailing list.

We use the information you submit for exactly one purpose: to respond to your enquiry or your proposal and, if you engage us, to deliver the services you have asked for. We do not add you to a marketing list, a drip sequence, or a newsletter as a result of contacting us.

We will never use information you share with us during a security engagement for any purpose other than delivering that engagement.

We do not sell, rent, or trade personal information. We share it only with service providers who help us operate this website and communicate with you, for example our email delivery provider and our hosting provider, and only to the extent needed to perform that function.

We may disclose information where we are legally required to do so, or where necessary to protect our rights, safety, or property.

Information obtained during a penetration test or security assessment is governed by the confidentiality terms of the engagement agreement between us, which take precedence over this policy.

We do not publish client names, findings, or any identifying detail of a client environment without explicit written permission. This is why the testimonials on this site are attributed by role and region rather than by name.

Contact form submissions are retained for as long as needed to respond to your enquiry and to maintain a record of our business relationship. Engagement data is retained according to the terms of the relevant engagement agreement and then securely destroyed.

You may ask us to delete your information at any time using the contact details below.

Depending on where you live, you may have the right to access, correct, delete, or restrict processing of your personal information, or to object to it, and to request a portable copy. Residents of the EEA and UK have these rights under the GDPR; residents of California have comparable rights under the CCPA/CPRA.

To exercise any of these rights, email us at the address below. We will respond within the timeframe required by applicable law, and we will not discriminate against you for making a request.

We apply the same security practices we recommend to our clients: encryption in transit, least-privilege access to systems holding personal information, multi-factor authentication, and regular review of who can access what. No system is perfectly secure, but this is our profession and we treat it accordingly.

If we make material changes to this policy, we will update the date at the top of this page. Continued use of the site after a change constitutes acceptance of the revised policy.