[ Handling ]
You are handing us the keys.
Here is how we hold them.
This is the part of the engagement that nobody asks about on the first call and everybody thinks about afterwards. It is written down so you do not have to ask.
Each commitment appears in the engagement agreement.
Commitments
Eight, and they are contractual.
Each of these appears in the engagement agreement. If one of them is a problem for your insurer or your own policy, say so before we start — they can be tightened, and one of them being unworkable is not a reason to abandon the engagement.
A health check requires no write access to anything. If remediation is agreed later, write access is granted for that scope and revoked when it ends.
no write access to anythingWe ask for the narrowest access that lets the work happen, on accounts created for us rather than shared ones, and we ask you to disable them the day the engagement closes. If you forget, we will remind you.
we remind you to disable themThey come through a password manager share or a one-time secret link. Anything sent to us by email is treated as compromised, and we will say so and ask for it to be rotated.
emailed = compromisedWhere a restore or a copy is genuinely required — a backup test, for instance — it happens in an isolated environment that is destroyed at the end, and the report says it happened.
destroyed at the endWorking copies live on full-disk-encrypted machines, not on shared drives and not in a third-party AI tool. Nothing from your system is used to train anything.
nothing trains anythingWorking material is destroyed ninety days after the engagement closes, or immediately if you ask. The report itself we keep, because you may ask us for it again.
or immediately, if you askA vulnerability we find is yours. It is not a case study, it is not a conference talk, and it is not mentioned to anyone — including in anonymised form — without written permission.
yours, not oursRead access still occasionally causes something: a query that loads a server, a login that locks an account. If we cause it, it is in the report, named, whether or not you noticed.
named, whether or not you noticedIf we find something serious
Disclosure runs to you, immediately, ahead of the report.
If we find something that appears to be under active exploitation, or credentials already published in a breach corpus, you hear about it the same day by telephone. It does not wait for the report, and it does not wait for the invoice.
If the finding touches personal information in a way that may trigger a reporting obligation under Quebec's Law 25, we will say so plainly and in writing — and then point you at a lawyer, because we are not one and the deadline is yours to meet, not ours.
The order things happen in
What we are not
Honest limits.
No SOC 2 report
We are a small studio, not a certified assessor. There is no SOC 2 report behind this page and we are not going to imply otherwise — if your procurement process requires one, we are the wrong supplier and we would rather tell you now than at the end of a proposal.
Not a penetration test
A health check is a posture review conducted with source access. It is not a penetration test and does not replace one. Where a finding needs a specialist, the report says so and names what to ask for.
Ask about anything here.
If a commitment is a problem for your insurer or your policy, say so before we start. They can be tightened.