Data Processing & Security

• We collect only the information needed to scope, perform and report the assessment.
• Evidence is captured at the minimum extent required to demonstrate a finding.
• Where a finding can be evidenced without production data, we use test accounts and synthetic data.
• This website stores no assessment results; free-check submissions are relayed by email only.

• Sensitive values in reports are redacted unless you explicitly ask for them unredacted.
• Credentials issued to us for testing are used only for the agreed scope and revoked at engagement close.
• We ask you to rotate any credentials shared with us once testing concludes.

• Engagement material is stored encrypted at rest and transferred over encrypted channels.
• Access is limited to the personnel assigned to your engagement, on a least-privilege basis.
• Security-relevant actions on engagement material are logged.

Unless your agreement specifies otherwise, we retain engagement material for the period needed to complete retesting and support you afterwards, then securely delete it. You may request earlier deletion in writing, subject to any legal retention requirement.

We keep the number of subprocessors small and will disclose the current list on request. Where data is transferred across borders, we rely on the safeguards specified in your engagement agreement.

If we become aware of an incident affecting your data in our custody, we will notify your designated contact without undue delay, provide what we know, and cooperate with your response.

Questions about any of the above: hello@exploitlab.io.