Company
Trust and security
We ask clients for access to systems and candidates for their resumes. This page says what we do with both, and what we have not yet done.
Client work
-
Authorized testing only
We do not test a system without written authorization from someone able to give it, naming the exact targets, the window and the exclusions. We will not accept verbal permission for security testing.
-
Least access, time-limited
We ask for the access the work needs and no more, for as long as the work takes. Read-only where read-only is enough. Access is removed at the end of an engagement and we confirm when it is.
-
Evidence handling
Findings, screenshots and extracts are treated as sensitive. They are kept in a restricted location, shared with you through a secure channel, and deleted or returned on an agreed schedule after the engagement.
-
Production data
By default we do not use production customer data in non-production environments. Where there is no alternative, we agree masking or a subset with you in writing first.
-
Confidentiality
We expect to sign your non-disclosure agreement, and a business associate agreement where protected health information is involved. Our staff are bound by confidentiality obligations.
-
Offshore access
Our India team supports delivery and recruiting. Access to a client environment from outside the United States happens only where you have agreed it in writing, with the location and data restrictions you set.
Candidate information
- Resumes are stored outside the public part of the web server and can be opened only by signed-in staff.
- Staff accounts require a password and a second factor, and every access to an application is logged.
- We do not ask candidates for a Social Security number, date of birth, bank details or identity documents at application stage.
- Nobody is submitted to a client without agreeing to that specific role.
- Candidate records are deleted after 24 months from last contact, or sooner on request.
- No automated tool rejects a candidate. See our AI screening notice.
- We do not sell candidate or client information, and we do not pass it to advertisers.
- Full detail is in our candidate privacy notice.
Our own systems
A security firm with a careless website is not a good argument for itself. This site is built deliberately:
- No third-party scripts or fonts. Everything is served from this domain, so reading a page here does not report your visit to another company.
- A strict content security policy, with no inline scripts or styles, which removes most of the ways a cross-site scripting bug becomes an incident.
- Server-side validation on every form, with cross-site request forgery protection, an origin check, rate limiting and bot defences.
- Parameterized database access everywhere, and output escaping by default.
- Administrator accounts protected with argon2id password hashing and time-based one-time passwords, with an audit log of sensitive actions.
- Secrets outside the web root, read from a file that is not reachable over the web.
- Automatic deletion of leads and applications after 24 months.
- Security headers including HSTS, frame denial and a referrer policy.
If you find a flaw in it, we want to hear from you. Our vulnerability reporting page explains how, and we will not threaten anyone who reports in good faith.
How we run internally
-
Access control
Accounts are individual, never shared. Multi-factor authentication on email and on administrative systems. Access is reviewed when someone changes role and removed when they leave.
-
Devices and email
Company email runs on a managed provider with multi-factor authentication. Staff devices are kept patched, and client material is not kept on personal devices.
-
Vendors
We keep the list of services that touch client or candidate data short, and we name the main ones in our privacy policy rather than hiding them behind a generic sentence.
-
Incidents
If we had an incident affecting your data, we would tell you, say what we knew and what we did not, and keep telling you as we learned more. Any legal notification duty would be met.
-
Training
Phishing is the realistic threat to a firm our size, so staff are trained on it and encouraged to report rather than stay quiet about a mistake.
-
Improvement
We assess our own environment with the same methods we sell. Where we find a gap we cannot close yet, we record it and it stays on the list.
Questions people ask
Can you complete our security questionnaire?
Yes, honestly, which sometimes means answering no. We will not claim a control we do not have in order to pass a questionnaire.
Do you carry insurance?
Insurance details are confirmed in contracting, with the certificate, rather than claimed on a web page. Ask during procurement.
Will you sign our data processing agreement?
Yes, where it reflects what we actually do. We will raise anything in it we cannot honestly commit to rather than signing and hoping.
Where is our data held?
Site data is held on our hosting provider. Engagement material is held in our business systems. We work from the United States and India, so our own staff in either country may handle it unless your contract restricts that.
Who do I contact about security?
Our vulnerability reporting page covers reports about this website. For anything about an engagement, contact the engagement lead directly, or write to info@tetraconnects.com.
Related
-
Cybersecurity
Penetration testing, vulnerability and exposure management, detection and response, cloud, identity and AI security, and security engineering, delivered by specialists.
Tell us which of these is you
I need a technology project delivered
Describe the system, the change and the timeline. A technical lead replies to talk about scope.
Discuss a projectI need to hire technical talent
Send the role, headcount and start date. A recruiter confirms the details before sourcing starts.
Request talentMy systems may be at risk
Ask for an assessment, a penetration test or help fixing findings. Under attack now? Call.
Speak with a security expert