How SQUR earns your trust

Scoped Testing Only

A test starts only after two steps inside your account: you prove control of the target with a DNS TXT record carrying a token we issue, and you record the exact scope you authorize. Nobody can authorize on your behalf. Testing never extends beyond that scope, and out-of-scope hosts discovered during a test are recorded but not tested.

Rate Limits & Controlled Execution

All automated activity is rate-limited to prevent service disruption. Testing uses non-destructive techniques with configurable throttling. Production environments can specify additional safeguards.

Verified Findings Only

Every reported vulnerability is actively exploited and confirmed by SQUR's AI agents before appearing in your report. If we can't prove it's real, we don't report it.

No DoS, No Data Exfiltration

SQUR never attempts denial-of-service attacks or exfiltrates real data. When exploitation is needed to confirm a finding, it uses synthetic payloads in isolated test conditions.

Full Audit Trail

Every action taken during a pentest is logged with timestamps, reasoning, and evidence. Viewable in your dashboard and included in the final report for complete transparency.

Free Retest Included

After you remediate findings, retest for free to confirm vulnerabilities are resolved. The evidence loop closes: one test price covers the full fix-verify cycle.

Data Residency

• All customer data stored in EU cloud regions (europe-west1, Belgium)
• Storage, database and backups never leave the EU. Model inference by Google may be served outside the EU under Standard Contractual Clauses; see the DPA, section 6
• Data Processing Agreement (Art. 28 GDPR) published, with the sub-processor list

Encryption

• In transit: TLS 1.2+ enforced on all connections
• At rest: AES-256 managed encryption (Google Cloud KMS)
• Credentials and tokens stored separately from report data

Retention & Deletion

• Target configuration, findings, test artefacts and reports kept for 3 years after the end of the calendar year in which the test completed, then deleted
• Earlier deletion of a test, a target or the whole account on request, completed within 30 days and confirmed in writing
• Backups overwritten within 7 days of a deletion
• No sale of customer data to third parties

Access Control

• Role-based access control within customer accounts
• Least-privilege internal access to customer data
• Administrative and configuration changes to production systems logged and audited
• Data-access logging for production systems (file and record reads) is not yet enabled
• Multi-factor authentication required for all SQUR staff accessing production

Secure SDLC

SQUR's own platform is continuously tested using SQUR. Code changes go through automated security analysis, dependency scanning (Snyk, Dependabot), and SAST before deployment.

Infrastructure Security

Hardened container runtime. Network-level segmentation between customer environments. Strict content security policies. No shared compute between customers during active tests.

Vulnerability Management

Critical vulnerabilities patched within 24 hours. High severity within 7 days. Dependency updates on weekly automated schedule. Penetration testing of SQUR infrastructure conducted annually.

Incident Response

Defined incident response process with escalation paths. Customer notification within 72 hours for any data incidents, as required by GDPR Article 33. Post-incident reports available on request.