You are trusting us with your systems. Here is how we treat them.

An external review needs no access at all — no agent, no credentials, no VPN. We look at what an attacker on the internet can see, nothing more.

For internal work, testing runs on a node inside your network that you control. Any credentials you grant for authenticated checks are stored and used on that node only; they are never sent to us.

Every engagement is defined in writing first: the targets, the testing window, what is in and out of bounds, and who to call if something looks wrong during the test. You approve it before we touch anything, and the scope is enforced technically — the engine will not test an address that is not on the list.

We run the technical side of every cyber review with Cyentrix Scan, our own engine, rather than a stack of third-party SaaS scanners. Raw evidence stays on the node; only the verified, sanitised findings we put in your report leave your network.

We keep what is needed to deliver and re-test the engagement: the findings, the report and the evidence behind each finding we reported. We do not keep raw scan output, and we do not keep credentials. Retention is agreed in the scope; the default is to delete engagement data after the re-test is complete, with a copy left with you.