Least-privilege operations
Access to production systems and client environments is restricted to the personnel required for the engagement, reviewed regularly and removed when no longer needed.
Company · Trust
Security & responsible disclosure
How we protect information, how to report a vulnerability, and the standards we hold ourselves to.
Our practices
How we handle security
We only claim practices we actually operate. These are the controls that govern our own work.
Confidentiality by default
Client environments, findings and data are treated as confidential material belonging to the client. Access is limited, logged and governed by written agreements.
Secure handling of findings
Assessment and testing evidence is stored in access-controlled locations, encrypted in transit and at rest, and retained only as long as required to deliver the engagement.
No secrets in the open
We do not embed credentials or sensitive configuration in client-facing code, and we review artefacts before delivery to prevent accidental disclosure.
Responsible disclosure
Reporting a vulnerability
If you believe you have found a security issue in a Netralink system, we want to hear from you.
- 01
Report privately
Email your finding to security@netra-link.com with enough detail to reproduce the issue. Please do not open public tickets or share details before we have responded.
- 02
We acknowledge
We aim to acknowledge reports within two business days, and to provide an initial assessment within five business days.
- 03
Coordinated resolution
We investigate, remediate and keep you informed. Where appropriate, we agree a disclosure timeline with you before any public discussion.
Security contact
Ground rules
Researcher expectations
Good-faith research is welcome. To keep it lawful and useful, please respect these boundaries.
- Do not access, modify or delete data that is not your own.
- Do not run denial-of-service tests or high-volume automated scanning.
- Do not use social engineering against Netralink staff or clients.
- Report only issues affecting systems you can reasonably identify as ours.
Data handling
Information we protect
The data our clients entrust to us — and the commitments attached to it.
- Client findings are confidential and shared only with authorised client personnel.
- Evidence is encrypted in transit and at rest, with access limited and logged.
- Personal data submitted through this website is handled per our Privacy Policy.
- Engagement data is returned or destroyed at the end of an engagement as agreed in writing.
Security questions before an engagement?
Ask us how we handle confidentiality, access and evidence before any contract is signed. We are happy to answer in detail.