Least privilege
Access limited to what scope requires. Credentials under agreed confidentiality terms.
HOW WE OPERATE
Secure by design.
Transparent by default.
We handle sensitive client information and produce security findings. Operational discipline is not optional.
Per engagement
agreed before work starts
- Access
- You share only what we need for this engagement.
- Reports and evidence
- Confidential. Nothing shared outside what we agreed.
- Testing
- Written scope before we start.
We agree this before work begins.
Operating principles
Minimal data collection
We request only what the engagement needs. Retention is agreed with a clear why and how long.
Careful reporting
Findings documented with assumptions and limitations, usable by engineering and management.
Open standards
Sigma, MITRE ATT&CK, standard file formats. No opaque proprietary lock-in on outputs.
Every point explained
Every recommendation links to something we actually looked at. No advice without a reason.
Tight operations
Written test agreements before we start. Clear rules for access, evidence, and handover.
Infrastructure controls
Before testing a client environment or handling sensitive materials, we ask: what could go wrong? What must stay confidential? Security discipline applies to how we operate, not only to what we deliver.
Platform controls
AccessSSH key-only · non-root containers
NetworkIsolation between engagement environments
BackupsEncrypted · tested restore procedures
ResponseDocumented incident response runbooks
Other topics
Privacy
Data & privacy
Data handling per assignment. Clear agreements upfront. You own the outputs.
ReadScope-first
How we work
Clear assignments with fixed outputs. Boundaries agreed before work starts.
ReadOps discipline
How we operate securely
Secure by design, transparent by default. Operational discipline for client data and findings.