Security
What this platform enforces, and what we do not claim
A vendor asking to test your systems is asking for more trust than most suppliers ever need. This page is written to be checked rather than believed: what the software actually refuses to do, where your data sits, how to report a flaw in us, and which assurances we do not have.
Reporting a vulnerability in this platform
Start at /.well-known/security.txt,
which is published to RFC 9116
and names a contact address and an expiry date. Reports go to
security@exceptionsecurity.com,
or through
our own disclosure page if you
would rather use a form — no account, and an email address only so that we
can answer you.
That page runs on the same intake we give clients, which is deliberate: a supplier who offers to receive your vulnerability reports and does not publish a way to receive its own is asking you to take something on faith.
We will not threaten you for telling us. Test against your own account, stay out of other people's data, and give us a reasonable chance to fix something before you publish it. There is no reward programme for this platform today, and we would rather say so than imply one exists.
What the software refuses to do
These are not policies written next to the product. Each is a rule the system applies to a request, and each is the sort of thing you can ask us to demonstrate on a call rather than take on trust.
Access stops at the window you set, and out-of-scope work is refused
Authorisation is checked on every request, not at login: the researcher's verified identity, their acceptance, their signed NDA, the engagement being live, and the dates you set. Outside the window, the platform refuses access to your engagement and refuses any finding. A finding against an asset you recorded as out of scope is refused too. None of this relies on a contract reminder or a review afterwards, and when the window closes, access closes with it.
One precision: we do not sit in the network path between a researcher and your systems. What the platform controls is access to your engagement and what can be submitted against it, and every refusal lands in the audit trail below.
The audit trail cannot be rewritten after the fact
Every consequential action is recorded into a hash-chained log: each entry carries a digest of the one before it, so an entry cannot be altered or removed without breaking the chain from that point forward. The chain is verifiable on demand, and it constrains us as much as anyone — we cannot quietly edit our own record of what happened either.
Neither side is handed the other's identity
The platform never gives a researcher your organisation's name, your officers or your contacts, and you never see a researcher's legal identity, only a stable pseudonym and the fact that a person verified them. Both are enforced in the data the platform returns, not by asking people to be discreet. The scope itself may identify you, which is unavoidable when someone has to know what they are allowed to test.
Nothing is published without your approval of the exact wording
No finding, write-up or reference to your organisation is published unless you have approved the specific text. This is a step in the software, not a clause you have to enforce later.
Evidence is encrypted, and it is deleted on a schedule
Evidence is encrypted with AES-256-GCM before it reaches storage, and retention is enforced by a scheduled sweep that deletes artefacts when their period ends. A destruction commitment you cannot execute is not a commitment; this one runs whether or not anyone remembers it.
Accounts carry a second factor
Every role but a pending applicant requires a second factor, and a passkey satisfies it — the fingerprint, face or PIN that already unlocks the device, with nothing to copy down and nothing to lose. Authenticator apps remain available for anyone who prefers them.
Where your data lives, and who else touches it
| What | Where | Why |
|---|---|---|
| Application and database | Oracle Cloud, Mumbai, India | Runs the platform |
| Evidence artefacts | Cloudflare R2, encrypted before upload | Stores findings evidence |
| Job queue, cache and rate limits | Upstash (managed Redis) | Background jobs and counters; no evidence and no identity documents |
| Email the platform sends | Zoho Mail, India region | Notifications: recipient address and message |
| Email we send and receive as people | Zoho Mail, India region | Correspondence with you |
That is the whole list of parties that touch client data, and it matches our privacy notice. Cloudflare answers DNS for the domain and sees no client data: traffic reaches our own server directly, which holds the TLS certificate. If your organisation requires data to stay in a particular region, raise it before an engagement rather than during one. It is a deployment decision, and it is far cheaper to settle in advance.
No external AI service processes client data. Findings, evidence and client material are not sent to a third-party model. Any automated analysis runs on our own server.
One precision that matters: encryption at rest is not end-to-end. The platform decrypts evidence in order to triage it, which is what makes triage possible at all. Anyone who tells you otherwise about a service that reviews your findings has not thought it through.
Who is allowed to work on your systems
Participation is invitation-only. A researcher reaches an engagement only after their identity is verified and their account is active. No reward is paid into a comprehensively embargoed jurisdiction: the platform refuses that payout. Each engagement carries a written authorisation and a non-disclosure agreement covering the named scope.
How the site itself is configured
Small things, but they are checkable in your browser's network tab in under a minute, and a vendor that has not done them on its own domain is telling you something:
- HSTS for two years, subdomains included.
- Framing denied outright, by both
X-Frame-Optionsand aframe-ancestorsheader — a sign-in page that can be framed is a clickjacking setup. nosniff, a strict referrer policy, and an opener policy that severswindow.opener.- Camera, microphone, geolocation, payment and USB denied by permissions policy, because nothing here asks for them.
- The server version header removed — a version number is free reconnaissance.
What we do not claim
We are not ISO 27001 or SOC 2 certified, and we have not yet commissioned an independent penetration test of this platform. We will not describe an audit as under way when it is not, and we would rather lose a procurement round than have you discover that later.
What a certificate tells you is that an auditor reviewed a set of controls on a date. What we offer instead is narrower and, for this kind of work, more useful: ask us to show you the platform refusing an action outside an authorised window, and the refusal landing in an audit chain that cannot be rewritten. It takes about fifteen minutes on a screen share.
Exception Security runs private, invitation-only offensive security engagements. There is no subscription, setup fee or retainer — clients are billed only for a finding they have accepted, at a reward they set. Security questions about the platform go to security@exceptionsecurity.com; anything else to support@exceptionsecurity.com.