Skip to content

Security

How we hold up our own end.

We test other people’s systems for a living, which makes our own posture fair game. This is what we do, and what we have not done yet.

What we do

Access
Least privilege by default. Production access is granted per engagement rather than standing, and every account uses hardware-backed or app-based multi-factor authentication. Credentials are held in a managed secrets environment, never in a repository or a shared document.
Client data
We take the minimum needed to do the work. Where we can work against synthetic or anonymised data, we do. Anything we hold is encrypted at rest and in transit, and is deleted on request or at the end of an engagement.
Isolation
Client environments are kept separate. In systems we build, tenant isolation is enforced at the data layer rather than in application code, so a missed condition in a query cannot become a cross-tenant leak.
Our own code
Reviewed before merge, dependencies monitored for known vulnerabilities, and secrets scanned for on every commit. The site you are reading sets its own response headers and publishes a disclosure policy.
If something happens to us
Any incident affecting client data is communicated directly and promptly, with what we know at the time rather than after it is tidy. We would rather tell you early and be incomplete than late and polished.

What we have not done yet

  • We are not SOC 2 certified. We do the technical work that makes those audits pass, and we will say so plainly rather than implying accreditation we do not hold.
  • We are not an accredited penetration-testing certification body.
  • A formal bug bounty is not running yet — reports are handled directly through the address below.

Reporting a vulnerability

If you have found a weakness in something of ours, we want to hear about it. We will not pursue legal action against anyone reporting in good faith, and we will credit you unless you would rather we did not.

Report to
[email protected]
Acknowledgement
Within two working days
Assessment
Within ten working days
Machine-readable
/.well-known/security.txt

Please do

  • Give us enough detail to reproduce it
  • Give us reasonable time before publishing
  • Test only against accounts you own

Please don’t

  • Access or modify data that is not yours
  • Run denial-of-service or spam testing
  • Use social engineering against our people or clients

Raedal Tech Lab Limited · Company no. PVT-BEUXY99G

Our security practice