Privacy Policy

When you submit the contact form on this website, we collect the information you choose to provide: your name, work email address, company name, and optionally your phone number, area of interest, timeline, and the details of your message.

This website does not use advertising cookies, tracking pixels, or third-party analytics. We do not build advertising profiles, and we do not sell or rent personal information to anyone, ever.

Our hosting provider may retain standard server logs (IP address, user agent, timestamp, requested URL) for security and operational purposes. These logs are not linked to form submissions or used to identify individuals.

We use the information you submit for exactly one purpose: to respond to your enquiry and, if you engage us, to deliver the services you have asked for. We do not add you to a marketing list, a drip sequence, or a newsletter as a result of contacting us.

We will never use information you share with us during a security engagement for any purpose other than delivering that engagement.

We do not sell, rent, or trade personal information. We share it only with service providers who help us operate this website and communicate with you, for example our email delivery provider and our hosting provider, and only to the extent needed to perform that function.

We may disclose information where we are legally required to do so, or where necessary to protect our rights, safety, or property.

Information obtained during a penetration test or security assessment is governed by the confidentiality terms of the engagement agreement between us, which take precedence over this policy.

We do not publish client names, findings, or any identifying detail of a client environment without explicit written permission. This is why the testimonials on this site are attributed by role and region rather than by name.

Contact form submissions are retained for as long as needed to respond to your enquiry and to maintain a record of our business relationship. Engagement data is retained according to the terms of the relevant engagement agreement and then securely destroyed.

You may ask us to delete your information at any time using the contact details below.

Depending on where you live, you may have the right to access, correct, delete, or restrict processing of your personal information, or to object to it, and to request a portable copy. Residents of the EEA and UK have these rights under the GDPR; residents of California have comparable rights under the CCPA/CPRA.

To exercise any of these rights, email us at the address below. We will respond within the timeframe required by applicable law, and we will not discriminate against you for making a request.

We apply the same security practices we recommend to our clients: encryption in transit, least-privilege access to systems holding personal information, multi-factor authentication, and regular review of who can access what. No system is perfectly secure, but this is our profession and we treat it accordingly.

If we make material changes to this policy, we will update the date at the top of this page. Continued use of the site after a change constitutes acceptance of the revised policy.