Trust
Trust and data handling
You give us access to your systems and see the results before anyone else. Here is how we protect that access, your data and your business while we test.
Confidentiality
NDA by default.
We sign a non-disclosure agreement before you share anything about your systems. Your findings, your reports and the fact that you work with us stay confidential.
We never name clients, publish client findings or reuse your data in marketing. Our sample report is a redacted example, not a real client’s report.
Data handling
Protected end to end.
- Encryption in transit for every exchange of credentials, data and reports
- Encryption at rest for all engagement data and evidence, including full-disk encryption on our laptops
- Multi-factor authentication on every online account that holds client data
- Least-privilege access: only the testers on your engagement can see your data
- Your evidence and test credentials kept in their own storage area, never mixed with another client’s
- Test credentials used only for the agreed scope and window
Retention and deletion
We keep your data only as long as we need it.
We agree a retention period with you as part of each engagement. By default, once you have accepted the final report and that retention period has passed, we delete client data, evidence and test credentials from our systems.
If you need a different period, for example to support an audit cycle, or want written confirmation of deletion, tell us at scoping and we will put it in the engagement terms.
Testing safety
Rules of engagement, agreed up front.
A penetration test should find weaknesses, not cause outages. Every engagement runs under rules you approve.
Written authorisation
Testing starts only after you have signed off scope, targets and rules of engagement.
Agreed testing windows
We test when you say we can, and work around your releases and busy periods.
Critical issues reported immediately
If we find something serious, we tell your named contact straight away instead of waiting for the report.
Stop on request
If you ask us to pause or stop, we stop at once. No destructive testing without your explicit approval.
Our own security
We hold ourselves to the same standard.
A security company should be easy to check. This website uses strict security headers and no third-party trackers. We publish a vulnerability disclosure policy and a machine-readable security contact.
Data protection
Data processing agreements on request.
If you are subject to the GDPR or similar laws, we can sign a data processing agreement covering the personal data we may encounter during testing. Ask for one during scoping.
Security questions or a questionnaire?
Ask about how we handle your data, or send us your security questionnaire to complete.
security@rudranetra.comNeed a pentest for an audit, a customer, or peace of mind?
Tell us what you need tested. You’ll get a fixed-fee proposal with tester-days and timeline stated, usually within a few days of the scoping call.