Confidentiality Policy

1. Our commitment

We treat the existence of an engagement, your identity, the content of your channel, technical findings, deliverables, and all related information as strictly confidential. We do not name clients in marketing. We do not publish case studies that identify clients. We do not discuss live or past engagements with third parties without express written consent.

2. Scope

This policy applies to all:

• Messages exchanged through the chat channel and any successor channels.
• Engagement letters, scope documents, invoices, and correspondence.
• Forensic artefacts, logs, indicators, screenshots, and other technical material received from you.
• Hackastra deliverables (findings reports, remediation plans, advisories) prepared for you.

3. Staff & contractor obligations (NDAs)

• Every member of the Hackastra response team — employees and approved contractors — signs a written confidentiality and non-disclosure agreement (NDA) as a condition of access.
• Access to client information is granted on a strict need-to-know basis. Each engagement has a named lead responder and a minimal supporting team.
• Access permissions are reviewed periodically and revoked immediately on a team member leaving the engagement or the company.
• Confidentiality obligations on our team survive termination of employment or engagement indefinitely.

4. Data handling

• All traffic to and from hackastra.com is encrypted in transit using HTTPS / TLS.
• Operator credentials are stored only as one-way bcrypt hashes. Operator sessions use short-lived signed tokens.
• Engagement data is segregated per engagement so that one client's data cannot be observed by another client's response team.
• Storage media and backups are encrypted at rest.
• On request, we will move sensitive material to an out-of-band, end-to-end encrypted channel within minutes.

5. Vendors & subcontractors

We use a small number of vetted infrastructure vendors (for example, hosting, email delivery, and database providers) strictly to operate the service. Those vendors are bound by written confidentiality terms equivalent in substance to this policy. Where an engagement requires specialist subcontractors (for example, a forensic data-recovery partner), they are engaged only with your prior written consent and under a back-to-back NDA.

6. Disclosure exceptions

Hackastra will not voluntarily disclose your information. We may disclose where (a) you have given us prior written consent, or (b) we are compelled by a valid order of a competent UAE court or authority. Where lawfully permitted, we will notify you before disclosure so that you may take protective measures, including seeking a protective order.

7. Marketing & references

We do not use client engagements as marketing material by default. If you wish to serve as a reference or co-author a redacted case study, that decision is yours, in writing, after the engagement closes.

8. Post-engagement

At the close of an engagement, we will, on request: (a) return or destroy forensic artefacts and other client-supplied material that we no longer need to hold; (b) purge channel transcripts; and (c) retain only the minimum records required by UAE law. Some retention is required by law and cannot be waived.

9. Breach response

If Hackastra becomes aware of a confidentiality or personal-data breach materially affecting you, we will notify you and, where required, the competent UAE authority, in line with our obligations under UAE Federal Decree-Law No. 45 of 2021 and any other applicable laws.

10. Contact

Questions about this Policy or to file a confidentiality concern: legal@hackastra.com.