Information Security Policy

This Policy sets out the principles and the rules by which Osaühing Ida Portal, registry code 10970449 (the “Operator”, “we”), protects information when it provides its services under the name Security Test Team.

The Policy applies to all information that the Operator receives from clients or obtains while it performs a security check or a security assessment, to the website of the Operator and to the systems in which such information is processed.

The Policy binds the members of the management board, the employees and the contractors of the Operator (the “Personnel”).

The Operator protects the confidentiality, the integrity and the availability of information.

The Operator collects and keeps only the information that the task requires, and only for as long as the task requires.

Access to information is granted to the persons who need it for the task, and to no one else.

The Operator acts on the systems of a client only with the written authorisation of their owner and within the scope of that authorisation.

The management board of the Operator is responsible for this Policy, for the resources that its implementation requires and for its review.

Every person of the Personnel undertakes in writing to keep information confidential before obtaining access to the information of a client. The undertaking remains in force after the cooperation with that person has ended.

The Personnel is bound by the Code of Ethics. A breach of this Policy or of the Code ends the cooperation with the person responsible.

The following is confidential: the fact that a person is a client of the Operator, the content of requests and contracts, the information about the systems of a client, vulnerabilities, evidence, reports and the correspondence with a client.

Confidential information is disclosed only to the client it concerns and to the persons the client has named in writing. Vulnerabilities, evidence and reports are passed on only to the client or the owner of the system concerned and, with its written consent, to those who remedy the vulnerabilities or coordinate their remedy. Requests and correspondence are also processed by the suppliers of Section 10, to the extent their service requires.

Information about one client is not used in the work for another client.

The code, the data and the vulnerabilities of a client are not submitted to public services of artificial intelligence and are not used to train models.

Every person of the Personnel works under a personal account. Shared accounts are not used.

Access to the systems in which the information of clients is processed is protected by multi-factor authentication.

Access to the information of an engagement is granted to the specialists assigned to that engagement and is withdrawn when the engagement is closed or the person leaves it.

Credentials that a client provides for testing are used only for that testing, are stored encrypted and are destroyed when the engagement is closed. The Operator recommends that the client revoke them after the testing.

The information of clients is stored encrypted, both on the devices of the Personnel and in the systems of the Operator.

Reports, evidence that allows a vulnerability to be reproduced, and credentials are transferred through a secure channel agreed with the client beforehand. They are not sent by email, through messengers or through the forms of the website.

The key to an encrypted document is communicated through a channel other than the one through which the document is sent.

The Operator records the minimum that proves a vulnerability. Personal data is not copied and is masked in the evidence wherever the proof remains valid.

If the specialist obtains access to data that is not needed to prove a vulnerability, the specialist stops, does not keep the data and informs the client.

The working data of an engagement is destroyed 30 days after the engagement is closed. The report is kept for as long as the contract provides.

Critical and high findings of a paid engagement are reported to the client within 24 hours of confirmation, without waiting for the report.

The devices on which the information of clients is processed have encrypted storage, a screen lock and supported, up-to-date software.

Testing is performed from the network addresses stated in the authorisation, so that the client can tell the actions of the Operator from the actions of third parties.

The tools used for testing are obtained from their official sources and are kept up to date.

The website securitytest.team is protected by the following measures:

1. (a)the website is served over encrypted connections only, and browsers are instructed to use no other connections;
2. (b)a content security policy permits only the scripts and the styles of the website itself and of the abuse check of the forms;
3. (c)the website sets no cookies and contains no analytics or advertising technologies;
4. (d)the forms are protected by an automated abuse check, and what is sent through them is validated both in the browser and on the server.

Requests are processed as follows:

1. (a)the service that stores requests cannot be reached from the internet and accepts data from the website only;
2. (b)no more than 5 requests are accepted from one network address within 60 minutes;
3. (c)the IP address of a requester is stored as a keyed hash; the address itself is not stored;
4. (d)a request is erased automatically 365 days after it was received.

Vulnerabilities of the website are reported as described in the Vulnerability Disclosure Policy.

The Operator engages a supplier who processes the information of clients only if the supplier ensures a level of protection not lower than this Policy requires.

The suppliers who process personal data are named in the Privacy Policy.

A person of the Personnel who notices a breach of security or suspects one reports it to the management board without delay.

The Operator contains the incident, establishes its causes and its consequences, and takes measures that prevent its repetition.

The Operator informs a client whose information is affected by an incident without undue delay and provides the information the client needs in order to respond.

Where an incident is a personal data breach, the Operator acts in accordance with Articles 33 and 34 of Regulation (EU) 2016/679.

A suspected breach of the security of the Operator can be reported to info@securitytest.team.

The Operator reviews this Policy at least once a year and after every security incident and every material change in its services or systems.

The version in force is the one published on this page, with the date from which it applies.