HackGuardX Trust & Governance Centre

Built on verifiable security, read-only access, and lawful testing.

As a UK cybersecurity provider, we hold our own infrastructure and testing practices to the highest standard. Review our technical safeguards, data residency guarantees, and legal agreements below.

Authorised Testing Only

Unverified domains receive strictly passive DNS/header checks. Active scanning unlocks only after cryptographic ownership proof.

Ephemeral Code Scanning

Private GitHub source code is analysed in isolated, ephemeral containers and purged immediately after each scan completes.

100% Read-Only Cloud & M365

We connect via AWS SecurityAudit, Azure Reader, and Microsoft Graph Policy Reader scopes—we never read staff emails or mutate resources.

UK & EU Data Residency

All customer workspace data and scan telemetry is encrypted at rest (AES-256-GCM) and in transit (TLS 1.3) in UK/EU regions.

Legal, Privacy & Security Policies

Reviewed 20 October 2026

Privacy Policy (UK GDPR & Data Protection Act 2018)

How HackGuardX Ltd collects, processes, protects, and respects personal data across our website and security platform.

Read Policy
Reviewed 20 October 2026

Cookie Policy (PECR & UK GDPR)

Transparent breakdown of essential security cookies, session tokens, and optional analytics used on HackGuardX.

Read Policy
Reviewed 20 October 2026

Terms of Service & Subscription Agreement

Commercial terms governing access to the HackGuardX cybersecurity platform, subscriptions, and Authorised Target warranties.

Read Policy
Reviewed 20 October 2026

Acceptable Use Policy (AUP)

Strict rules prohibiting unauthorised third-party scanning, denial-of-service testing, and platform misuse.

Read Policy
Reviewed 20 October 2026

Vulnerability Disclosure Policy (VDP) & security.txt

Safe harbour guidelines for security researchers reporting potential vulnerabilities in HackGuardX's own infrastructure.

Read Policy
Reviewed 20 October 2026

Data Processing Agreement (UK GDPR Article 28 DPA)

Standard contractual clauses governing how HackGuardX processes technical telemetry and personal data on behalf of customers.

Read Policy
Reviewed 20 October 2026

Service Level Agreement (SLA)

Platform availability commitments, alert delivery latency targets, and support response times for Business, Pro, and Managed plans.

Read Policy
Reviewed 20 October 2026

Responsible Testing & Authorisation Policy

How HackGuardX separates passive public inspection from verified active security testing to ensure 100% legal and operational safety.

Read Policy
LIVE PLATFORM SECURITY & ADAPTER DIAGNOSTICS

Production Security Posture & Environment Status

CSP, HSTS, X-Frame-Options & Rate Limiting Active
HTTP Security Headers (next.config.ts)
• Strict-Transport-Security (2yr + Preload)
• Content-Security-Policy (Strict Default)
• X-Frame-Options: DENY & nosniff
• Permissions-Policy & Referrer-Policy
API & Bot Guardrails
• Zod Schema Validation on all 5 API routes
• IP Rate Limiting on /api/exposure-check
• Internal/RFC1918 SSRF Hostname Blocker
• Honeypot Bot Filtering Enabled
CRM, Billing & Calendar Adapters (.env.example)
• CRM Provider: mock
• Stripe Adapter: Sandbox checkout preview (no keys)
• Calendar: calendly
Need our security questionnaire pack or Cyber Essentials verification certificate?Request Security Pack