Certifications our practitioners hold
Our consultants hold industry-recognised offensive-security and governance credentials. Certifications are held by individual practitioners on the delivery team.
How we handle your data
NDA-first engagements
Every engagement starts under a mutual NDA. Scope, rules of engagement, and data handling are agreed in writing before any testing begins.
Least-privilege access
We request only the access a test requires, for only as long as it is needed. Credentials are rotated or revoked at engagement close.
Encrypted in transit & at rest
Findings, evidence, and reports are exchanged over encrypted channels and stored encrypted. Sensitive artefacts are shared through access-controlled delivery.
Defined data retention
Engagement data is retained only for the agreed period, then securely destroyed. Retention terms are set per contract.
How we test and report
100% manual validation
Every reported finding is manually verified and reproducible — no raw scanner output, no unvalidated false positives.
Evidence-led reporting
Each finding ships with proof, business-context risk rating, and clear remediation guidance your engineers can act on.
Free remediation retest
We retest fixed findings to confirm closure, so you can evidence remediation to auditors and customers.
Responsible disclosure
Our team has responsibly disclosed 50+ CVEs. We follow coordinated-disclosure practice on any third-party issues found.
Standards we work to
We deliver assessments and advisory mapped to the frameworks our clients are accountable to — ISO/IEC 27001, SOC 2, PCI DSS, GDPR, HIPAA, and India's DPDP Act, RBI, SEBI, and IRDAI requirements. Our own engagement practices are aligned to these standards.
For a security questionnaire, SoW, or a copy of our standard NDA and data-handling terms, reach out and we'll respond promptly.