Security
How we handle your systems and data. Security and data handling at PACSAL.
When you give us access to a system, a codebase, or a network, you are trusting us with something that matters. These are the rules we work to on every engagement.
In short
- Written authorisation before any testing
- NDA before you share anything sensitive
- Access removed and data cleaned up afterwards
Our Commitments
Six rules on every engagement.
Written authorisation first
Nothing is tested until the system owner signs off on the scope: which systems, when, which methods, and who to call.
Confidential by default
We sign your NDA before you share anything sensitive. Findings go only to the contacts you name.
Only the access we need
We ask for the least access the work requires, use named accounts instead of shared passwords, and hand access back at the end.
Your data stays yours
Customer data is never copied beyond what is needed to prove a finding, and never used for anything else.
Serious issues reported at once
A critical finding is reported as soon as it is confirmed, not saved for the final report.
Clean-up afterwards
Test accounts and tools are removed, and evidence is deleted or returned at the end of the engagement, as agreed.
Engagement Lifecycle
From first call to clean-up.
The same five steps on every security engagement, so you always know what happens next.
- 01
Scope & NDA
Agree the systems, limits, timing, and confidentiality terms.
- 02
Authorise
Written sign-off from the system owner before anything starts.
- 03
Test
Work only inside the agreed scope and testing windows.
- 04
Report
Findings, severity, and fixes, walked through with your team.
- 05
Clean up
Access removed, test data deleted or returned, as agreed.
Our Own House
The same standard inside PACSAL.
We apply to ourselves what we would check for you.
- Two-factor authentication on company email and code accounts.
- Client code kept in private repositories in PACSAL's GitHub organization, where every member must use two-factor authentication.
- Local working copies of client code and data are deleted once the project is delivered.
- Specialists agree to the same confidentiality terms as the core team.
- Access removed as soon as a project or a person's role ends.
- This website runs on HTTPS only, sends security headers, and sets no tracking cookies.
Responsible Disclosure
Found a vulnerability?
If you believe you have found a security issue in pacsal.dev or a PACSAL product, email hello@pacsal.dev with the details and the steps to reproduce it. We acknowledge every report within 1 business day.
Report a security issuePlease
- Do not access, change, or delete data that is not yours.
- Do not disrupt the service or run denial-of-service tests.
- Give us reasonable time to fix the issue before sharing it publicly.
We do not run a paid bug bounty, but we will credit you if you would like.
Start a Security Test
Want to know where your systems stand?
Tell PACSAL what you run and what worries you. We will reply with a scope and next steps.