Trust Center
7 Minute Security is a cybersecurity consultancy. We spend our days finding weaknesses in other organizations' security, so we hold ourselves to the same standard we recommend to our clients, and we publish how we do it. This page is where that lives.
Everything here is current, versioned, and reviewed at least annually. Each policy carries its own change log so you can see how it has evolved.
Our policies
Signed master copies of each policy are maintained in Word format and are available to customers and partners on request.
How we protect your data
The policies above are the full picture. This is the short version: the things a client most often asks about.
- Every account a person signs in to has MFA. Passwords are unique, generated, and kept in an enterprise password manager. Automated connections that cannot present a second factor use key-based authentication locked to named source addresses.
- Your environment is reached only through MFA-protected, zero-trust remote access, restricted to named users. Nothing is exposed to the open internet.
- Deliverables never travel as email attachments. Reports go out as password-protected, encrypted links that expire after 7 days.
- We don't keep what we don't need. Credentials used during testing are deleted the day an engagement closes. Raw test data (scans, notes, screenshots) is purged 60 days after. Final reports are archived for 3 years, then securely destroyed.
- Report writing happens on a system you can't reach from the internet. Our authoring platform is self-hosted and restricted by firewall to known addresses.
- Every device meets a baseline, whether it belongs to us or to a subcontractor: MFA, active malware protection, full-disk encryption, patching to defined timeframes, and auto-lock. Devices we manage directly add application allowlisting and centralized security monitoring.
- If something goes wrong, you hear from us within 72 hours of a confirmed incident involving your data.
- Subcontractors are held to these same policies by written agreement, and re-attest to them every year.
Framework alignment
Our policies are aligned with the CIS Critical Security Controls. We do not currently hold a third-party attestation such as SOC 2; if that matters for your procurement process, ask us and we will tell you plainly where we stand.
Found a security issue in our systems?
We want to hear about it. Our Vulnerability Disclosure Policy explains what is in scope, how to report, what we commit to in return, and the safe-harbor terms for good-faith research. The short version: email security@7minsec.com.
Machine-readable contact details are at 7minsec.com/.well-known/security.txt. Researchers who have helped us are listed in our Hall of Thanks.
Need something that isn't here?
Some material (incident response runbooks, infrastructure details) is better shared under NDA than posted publicly. If your due-diligence process needs more than what is on this page, or you have a vendor security questionnaire for us to complete, email security@7minsec.com and we will take care of it.