Privacy, Confidentiality & Data Sanitization Policy.
esecnet handles sensitive scoping information, application binaries, credentials, and vulnerability findings under strict confidentiality and data-minimization controls.
This policy explains how we handle contact information submitted through our website as well as how we isolate, encrypt, and permanently purge technical artifacts during and after an authorized VAPT engagement.
Core data protection controls
- Bilateral NDA protection
- All client engagements operate under a signed Mutual Non-Disclosure Agreement
- Ephemeral testing workspaces
- Assessments run inside isolated environments separated per client engagement
- Data minimization in PoCs
- Zero bulk data exfiltration; sensitive records in proof-of-concept screenshots are redacted
- Post-engagement purge
- All binaries, logs, PCAPs, and test credentials are destroyed upon engagement closeout
How we handle engagement artifacts and client data
Different types of information are collected and processed at specific stages of an engagement and destroyed according to strict retention rules.
| Data / Artifact Category | Purpose of Processing | Storage & Protection Control | Retention & Sanitization |
|---|---|---|---|
| Website & Scoping Inquiries | Responding to scoping requests, preparing Statements of Work, and executing NDAs. | Access restricted to authorized esecnet engagement leads via encrypted email. | Retained only for active commercial correspondence or deleted upon request. |
| Test Credentials, VPN Profiles & API Keys | Executing authenticated Grey-Box and White-Box assessments across assigned user roles. | Stored in encrypted vaults during the active testing window; never shared across engagements. | Revoked by client and permanently deleted from esecnet vaults immediately after testing. |
| Application Binaries (APK, IPA, EXE) & Source Code | Static decompilation, binary analysis, and runtime instrumentation for Mobile and Thick Client VAPT. | Analyzed exclusively within encrypted, isolated virtual machines and dedicated test devices. | Securely wiped from all test devices and virtual machines upon engagement closeout. |
| HTTP/API Traces, PCAPs & Scanner Logs | Validating vulnerabilities, eliminating false positives, and constructing reproducible PoC steps. | Stored on encrypted local volumes inside the isolated engagement workspace. | Purged after final Remediation Verification Report delivery. |
| VAPT Deliverable Reports (Executive, Technical & Re-Test) | Providing the client with actionable remediation evidence and compliance attestation. | Transmitted exclusively to authorized client recipients via encrypted channels. | Purged from esecnet systems following agreed post-delivery retention window; Data Destruction Certificate issued upon request. |
1. Information collected via our website
When you contact esecnet via contact.html or email [email protected], we collect only the business contact and scoping details you choose to provide, including your name, work email address, organization name, primary VAPT service category, and target scope description. We do not use third-party advertising trackers, behavioral profiling pixels, or sell inquiry data to third parties.
2. Mutual Non-Disclosure Agreement (MNDA) and engagement confidentiality
Before receiving confidential architecture documentation, API schemas, source code, or non-public application builds, esecnet executes a Mutual Non-Disclosure Agreement (MNDA) with the client. All vulnerability findings, security posture metrics, and system details discovered during an assessment are treated as strictly confidential client property and are never disclosed to third parties without explicit written consent.
3. Data minimization during exploitation and proof-of-concept capture
When manual penetration testing uncovers a vulnerability that grants access to sensitive records, credentials, or Personally Identifiable Information (PII), such as Broken Object Level Authorization (BOLA/IDOR) or SQL injection, esecnet engineers follow a strict data-minimization protocol:
- We capture only the minimum metadata (such as schema headers, record counts, or synthetic test-account records) necessary to prove exploitability.
- We never download, exfiltrate, or store bulk production customer tables or payment data.
- Any sensitive values visible in HTTP traces or screenshots are masked or redacted prior to inclusion in the Technical Vulnerability Report.
4. Ephemeral workspaces and post-engagement data destruction
Each VAPT engagement is conducted within an isolated testing environment. Following delivery of the final Remediation Verification Report (or immediately upon written request by the client), esecnet permanently sanitizes and purges all engagement workspaces, decompiled binaries, proxy project files, network captures, and logs, and provides a signed Data Sanitization & Destruction Certificate upon request.
5. Regulatory alignment and data protection rights
Our data handling practices are designed to support client compliance obligations under GDPR, the Digital Personal Data Protection (DPDP) Act, SOC 2, ISO/IEC 27001, PCI-DSS, and HIPAA. Where required for enterprise vendor onboarding, esecnet executes a Data Processing Addendum (DPA) alongside the Master Services Agreement.
6. Contact for privacy and data sanitization requests
For questions regarding this Privacy Policy, to request a Mutual NDA or Data Processing Addendum, or to request data deletion, contact [email protected].