Home → Security
Security

How QryptoNox approaches client security.

Clear scope boundaries, least privilege, authorised testing, evidence handling and incident response.

Authorised scope

Public checks are limited to public information. Any authenticated review, code review, cloud access, active vulnerability testing or penetration testing requires written client authorisation and a defined scope.

Least privilege

Where access is needed, we request only the minimum access required for the agreed task and prefer read-only evidence or exports where they can answer the question reliably.

Evidence handling

Customer evidence is used for the engagement purpose, access is restricted, and retention/deletion expectations can be specified contractually.

Assessment levels

Different claims require different evidence.

Level 1 · Public Quantum Surface ScanPublic TLS/certificate metadata only. No intrusive probing. Not a complete CBOM.
Level 2 · Evidence-Led Crypto AssessmentQuestionnaires, architecture artefacts and customer-provided exports.
Level 3 · Verified Enterprise CBOMApproved discovery methods, read-only exports/connectors or other authorised evidence across the agreed environment.
Level 4 · Migration & ValidationRemediation planning, implementation coordination and evidence-based re-assessment.
Incident readiness

Response and reporting

QryptoNox maintains an internal incident-response process and will assess applicable notification duties, including CERT-In requirements, based on the incident and legal context. Enterprise contracts can define customer-notification timelines and escalation contacts.

Report a vulnerability

Safe harbour for good-faith reports

If you believe you found a vulnerability in a QryptoNox-owned system, use our Responsible Disclosure process. Do not access customer data, disrupt services or test third-party systems.

Responsible Disclosure →