Privacy Policy

Palfrey Security is a boutique offensive security consultancy providing web application penetration testing. We are responsible for personal data collected through this website.

For privacy requests, use the contact form or the email address listed on the contact page.

When you submit a contact inquiry, we collect your email address and the message you provide. This data is used solely to respond to your inquiry.

When you submit a booking request through the client portal, we collect the target URLs, pentest type, testing goals, out-of-scope items, environment details, tech stack, preferred report language, deadline, and budget range. Payment is handled outside this platform.

If you become a client, we create a portal account using your email address. Your password is hashed with Argon2id and never stored in plaintext. We do not store payment information; invoicing is handled out-of-band.

During an active pentest engagement, we process technical data about your application including the scope, discovered vulnerabilities, proof-of-concept materials, and remediation recommendations. This data is stored securely and is only accessible to you and the assigned tester.

When you log in to the client portal, a session identifier is stored in an HttpOnly, Secure cookie. This cookie cannot be accessed by JavaScript and is used solely to authenticate your requests. It is deleted when you log out.

Processing is necessary to perform the contract (Art. 6(1)(b) GDPR). We use your data to run engagements, deliver reports, and maintain your portal access.

We send CVE monitoring alerts to your email when new vulnerabilities are detected in your tech stack. Operational notifications (new booking, urgent call requests) go to our team only. We do not send marketing email.

Authentication events and admin actions are logged (actor ID, action, resource, timestamp) for audit purposes. We also store a peppered SHA-256 hash of the client IP address (not the IP itself) and, for unauthenticated login attempts, the submitted email address. This is necessary to detect and investigate credential-stuffing or targeted attacks. Legal basis: legitimate interest in platform security (Art. 6(1)(f) GDPR). Access to audit logs is restricted to administrators.

One session cookie is set on login. It holds an opaque session identifier used to authenticate requests. Strictly necessary under ePrivacy Directive Art. 5(3). Consent not required.

Your cookie notice choice is saved in localStorage under 'ps_cookie'. It never leaves your device and expires when you clear browser storage.

If you accept in the cookie notice, Google advertising cookies are set via Google's gtag.js to measure ad performance and conversions. They load under Consent Mode v2 with consent denied by default, so nothing is stored on your device or sent to Google until you opt in. Decline, or ignore the notice, and no advertising cookies are set. You can withdraw consent at any time by clearing the 'ps_cookie' value (or all cookies) in your browser. No Meta Pixel. No profiling of individual users.

CVE monitoring alert emails sent to clients are delivered via Resend, operating from EU infrastructure. Your email address is transmitted to Resend solely for the purpose of delivering these alerts. Resend is GDPR-compliant. See resend.com/privacy for their policy.

Pentest reports and engagement documents are stored in a private Cloudflare R2 bucket. Access is controlled via time-limited presigned URLs generated server-side. Documents are never publicly listed or accessible without authentication.

The login and contact forms use Cloudflare Turnstile as a privacy-friendly alternative to traditional captchas. When you load these forms, Turnstile receives your IP address and limited browser characteristics to score the request as human or automated. Turnstile does not set tracking cookies. See cloudflare.com/privacypolicy for their policy.

Only with your consent, Google LLC (United States) receives advertising and conversion data via gtag.js to measure the performance of our Google Ads campaigns. Transfers to the US rely on the EU-US Data Privacy Framework and Standard Contractual Clauses. Nothing is sent to Google unless you accept advertising cookies. See policies.google.com/privacy and policies.google.com/technologies/ads.

The application and database run on a dedicated VPS. The database is not exposed to the internet and is accessible only from authenticated server processes.

Reports and findings are kept for a minimum of 3 years from engagement close. After that, deletion or anonymisation can be requested.

Contact and booking submissions that did not become an engagement are deleted after 12 months.

Sessions expire after 14 days. Logging out invalidates the session server-side immediately.

Audit entries are kept for up to 12 months. They contain action metadata, a peppered hash of the client IP, and (for failed login attempts on unrecognised accounts) the submitted email address, retained for incident response.

You have the right to request a copy of the personal data we hold about you, along with information about how it is processed.

You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, or where you withdraw consent. Note that we may retain data where a legal obligation requires it or where an engagement is subject to a signed NDA.

If any personal data we hold is inaccurate or incomplete, you have the right to have it corrected.

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with your national data protection authority (e.g. BfDI in Germany, ICO in the UK, or your local EU supervisory authority).