# Your scope. Your data. Your control.

Understand how we scope testing, handle evidence, and keep you in control. Explore our operating practices and the details to agree for your engagement.

The status of each practice is shown below. Engagement-specific terms are agreed before testing.

## Testing under control

What is tested, how it runs, and how to stop it.

### Scope enforcement

LIVE

Every engagement starts with written scope: assets, exclusions, owners. Nothing outside it is touched.

### Execution isolation

LIVE

Validation runs in isolated environments with bounded load, windows, and techniques.

### Emergency stop

LIVE

A documented stop procedure and escalation contact before any execution starts.

## Evidence & data

Who can access the results and how they are handled.

### Evidence lifecycle

LIVE

Requests, responses, and reproduction steps captured per finding, shared only with named recipients.

### Encryption

LIVE

Encryption in transit and at rest for evidence and reports.

### Logging & audit trail

LIVE

Every action timestamped and attributable, exportable on request.

### Retention & deletion

LIVE

Defined retention per engagement, deletion on request and at close.

## Your engagement

Access, hosting, providers, and security contacts.

### Credential handling

TO DEFINE

Dedicated short-lived credentials with a defined lifecycle. Full process to be published.

### Hosting & residency

TO DEFINE

Local residency when the scope requires it. Architecture still being defined.

### Model providers

TO DEFINE

Any third-party models involved in analysis will be listed here with what they process.

### Subprocessors

TO DEFINE

No subprocessors at this stage. This list will grow here if that changes.

### Responsible disclosure

TO DEFINE

A coordinated disclosure path for issues found outside an engagement. Process being defined.

### Security contact

LIVE

Something urgent? Reach us through the contact page and mark it security-sensitive.

Business address: 145 avenue Allal Ben Abdellah - Rabat, Morocco

Source: https://hexbox-security.com/en/trust

Contact: contact@hexbox.ma