How we handle your data during an engagement
Xorabyte is a founder-led security practice. We don't run a platform with customer data in it today, so this page covers what actually happens to your systems, access, and information when you work with us.
How access works
We work inside your stack
We don’t ask you to move data into a platform we run. Engagements happen inside the tools you already use: your cloud console, your compliance tool if you have one (Drata, Vanta, or a spreadsheet), your ticketing system.
Least-privilege access
We ask for only the access a given engagement needs, scoped to that work. We don’t request broad admin access by default.
Access removed at engagement end
Any accounts, keys, or permissions granted for the engagement are revoked when it ends, not left active.
Named practitioner, not a bench
The person who scopes your engagement does the work. Nothing you share is handed off to a subcontractor or a junior team.
Confidentiality
NDA available
A mutual NDA is available before any sensitive material or systems access changes hands. Ask for one on the scoping call.
What we keep
Engagement materials, findings, and evidence are deleted within 90 days of the engagement ending, or sooner if you ask.
Communication on your terms
We use whatever channel you already trust: email, a shared Slack channel, or your own ticketing system. You don’t need to adopt new software to work with us.
Responsible disclosure
Found a security issue with xorabyte.com or anything we operate? Report it to security@xorabyte.com. We respond within one business day.