[ Privacy ]
What we hold, and for how long.
- Last updated
- 11 August 2026
What we collect from this website
If you submit a scoping request, the details you type are sent to our backend and stored so we can follow up. If the backend is unreachable, the form falls back to composing an email in your own mail client so no lead is dropped. We hold your name, company, email address and the scope description so we can reply.
We use Google Ads to measure the performance of our advertising. Google may set cookies on your device and collect data such as pages visited and whether you came from an ad click. This data is aggregated and does not identify you personally. You can opt out of personalised advertising at adssettings.google.com.
We do not sell or share data with third parties for marketing, and we do not build profiles of visitors beyond what is described above.
Engagement data
Findings, evidence and reports produced during an engagement live in an isolated tenant in our reporting platform, encrypted at rest and in transit. Access is limited to your named users and the testers assigned to your engagement, and that access is revoked when the engagement closes.
Retention follows what is agreed in your contract. You can export everything at any time, and request destruction of engagement data at any point after delivery.
Your rights
You can ask us what we hold about you, ask for it to be corrected, ask for a copy, or ask for it to be deleted. Write to [email protected] and we will respond within 30 days. If you are in the UK or EU, you also have the right to complain to your national data protection authority.
Contact
Privacy questions go to [email protected]. Vulnerabilities in our own systems go to [email protected].