Security Policy

🔐 Client Data Handling During Testing

Security testing requires access to sensitive systems. Here's how we handle your data responsibly throughout the engagement lifecycle.

Data Collection

During testing, we may collect:

• Application Data: URLs, endpoints, request/response samples, screenshots
• Test Credentials: Temporary accounts you provide for authenticated testing
• Vulnerability Evidence: Proof-of-concept payloads, logs, and exploitation artifacts
• Network Traffic: HTTP requests/responses relevant to discovered vulnerabilities

Data Minimization

Data Storage

Engagement data is stored securely:

🗑️ Data Deletion and Retention

Automatic Deletion Timeline

Early Deletion Requests

Need data deleted sooner? Contact us at hello@redteamkit.com. We'll securely wipe all engagement data within 7 business days and provide written confirmation.

Secure Deletion Process

• Multi-pass overwrite (DoD 5220.22-M standard)
• Cryptographic key destruction for encrypted data
• Backup purging from all systems
• Certificate of destruction available upon request

⚠️ Responsible Disclosure

If we discover critical vulnerabilities during testing that pose immediate risk to user data or system integrity, we follow a structured disclosure process.

Our Disclosure Protocol

1. Immediate Notification: We alert you within 4 hours of discovering critical issues (RCE, SQLi with data access, authentication bypass)
2. Pause Testing: Testing is paused until critical vulnerabilities are triaged
3. Secure Communication: Findings are shared via encrypted channels only
4. No Public Disclosure: We never publicly disclose vulnerabilities without your written consent
5. Remediation Support: We provide guidance and verify fixes before testing resumes

🛡️ Our Own Security Practices

As a security company, we're a high-value target. Here's how we protect our own infrastructure and operations.

Operational Security

Security Audits and Compliance

We undergo regular third-party security assessments:

• Annual Penetration Testing: External security firm tests our infrastructure
• SOC 2 Type II: Annual audit of security controls (in progress)
• OWASP Top 10: Our own web applications are tested against the same standards we use for clients
• Vulnerability Scanning: Weekly automated scans of all public-facing systems

🚨 Security Incident Response

Despite our best efforts, no system is 100% secure. If a security incident occurs affecting client data, we have a documented response process.

Incident Response Plan

1. Detection & Analysis (0-2 hours): Identify scope, affected data, and root cause
2. Containment (2-6 hours): Isolate affected systems, revoke compromised credentials
3. Client Notification (within 24 hours): Inform affected clients with known details
4. Eradication & Recovery (24-72 hours): Remove threat, restore from clean backups
5. Post-Incident Review (within 7 days): Root cause analysis and preventive measures

What You Can Expect

🐛 Security Researchers: Report Vulnerabilities

Find a security issue in our systems? We welcome responsible disclosure from the security community.

Scope

In-Scope:

• redteamkit.com (main website)
• app.redteamkit.com (client portal)
• api.redteamkit.com (API endpoints)

Out-of-Scope:

• Social engineering of employees
• Physical security tests
• Denial of service attacks
• Third-party services we use (report directly to them)

How to Report

Recognition

We don't currently offer monetary rewards, but we're happy to:

• Credit you on our security researchers page (with your permission)
• Provide a reference letter for your portfolio
• Offer a discount on our services for your own projects

📧 Contact for Security Concerns

Have questions about our security practices? Need to report a concern? We're here to help.