Trust and compliance
Your data, protected at every step.
Security work means trusting us with access to your systems and sensitive information. Here is exactly how ThreatGaurd protects it, from the first conversation to the final report.
Data protection
How we protect your data at every stage.
These safeguards apply to every engagement, whatever the service. They are confirmed in writing before any work begins.
-
Stage 01
Agree
Before anything is accessed.
- NDA signed before any access
- Written authorisation and agreed scope
- Rules of engagement and stop conditions
-
Stage 02
Access
While we work in your environment.
- Only the access the work needs
- Test accounts instead of real users where possible
- Work in testing windows agreed with you
-
Stage 03
Collect
When we gather evidence.
- Only the evidence needed to prove a finding
- No copying of client records or documents
- Sensitive values masked in reports
-
Stage 04
Deliver
When we share results.
- Encrypted report delivery
- Findings shared only with named contacts
- Critical issues raised with you straight away
-
Stage 05
Delete
When the engagement ends.
- Engagement data deleted after the engagement
- Retention agreed in advance where you need it
- Deletion confirmed on request
Safeguards can be adapted to your own security policies and data handling requirements during scoping.
Assurance
Everything your due diligence needs.
Choosing a security partner is a risk decision in itself. We make it easy for your security, procurement and legal teams to review us.
Available on request
Ask for any of the following during scoping or vendor onboarding.
- A mutual NDA before detailed discussions
- Data processing terms where personal data is involved
- Completed vendor security questionnaires
- Our rules of engagement and testing safeguards
- Details of how evidence is stored, shared and deleted
We handle personal data with care, in line with applicable data protection laws such as India’s DPDP Act and, where relevant, the GDPR.
Certifications and attestations
We list a certification or attestation here only once it is formally held, together with its scope and issuing body.
We never claim certifications we do not hold, and we are equally clear with clients about what our own services can and cannot certify.
Read about our approachResponsible disclosure
Found a security issue in our systems?
We welcome reports from security researchers and will work with you to understand and fix the issue. Please read our disclosure policy before testing or reporting.
Get started
Have a security or data protection question?
Tell us what your security, procurement or legal team needs to know. We will answer clearly and share the right documentation, with no obligation.
What happens next
- Tell us what you needQuestions, questionnaires or documents.
- A clear responseStraight answers from the people who do the work.
- Safeguards in writingAgreed and documented before any work begins.