How we protect your information.

Authorisation before any activity

No testing begins until a client representative with authority over every in-scope system has signed a written authorisation and agreed rules of engagement. Where systems are hosted or operated by a third party, we confirm that the necessary permissions are in place first.

The rules of engagement set out objectives, scope, exclusions, timings and emergency contacts. See how engagements work.

How we handle evidence

• We collect only what is needed to demonstrate a finding and its impact.
• Evidence is encrypted in transit and at rest, and stored in India.
• Access is limited to the named engagement team and is logged.
• Client data is never used to train tools or shared with other clients.

Retention and deletion

Engagement evidence is retained for 90 days after the final report is delivered, unless a different period is agreed in writing. It is then securely deleted, and we confirm deletion in writing on request.

Our people

Every consultant is bound by confidentiality obligations before working on an engagement. Every consultant is background-verified before working on an engagement.

Each engagement has a named lead who is accountable for conduct, communication and reporting from scoping to retest.

Confidential reporting

Reports are marked confidential, shared only with the recipients you nominate and delivered through an encrypted file-sharing portal. They are never sent as unprotected email attachments.

Insurance and documents

Insurance

Professional indemnity and cyber liability cover is being arranged. Details are available on request.

Documents

Available through our vendor onboarding pack.

If something goes wrong

If we become aware of an incident affecting client information in our care, we will notify your nominated contact within 24 hours and support your response.

Questions

For questions about how we handle information, contact red@ybmlabs.com. To report a vulnerability in our own systems, see our responsible disclosure policy.