How Foundation Zero handles customer trust.
Security work requires tight authorization, clear attribution, and careful data handling. These notes summarize the defaults we use when scoping discovery and validation work.
Data handling
Customer data is handled in US-region systems unless another arrangement is agreed in writing.
Access is engagement-scoped, time-bound, and limited to personnel needed to deliver the authorized work.
Customer data is not copied into public research, demos, training material, or reusable test corpora without written approval.
Testing attribution
Authorized probes can include customer-visible identifiers such as headers, job IDs, and trailing tokens so SOC teams can recognize Foundation Zero activity in logs.
Discovery and validation stay within agreed assets, windows, and test classes. Expansion requires explicit approval.
Procurement
Security questionnaires, DPAs, subprocessors, and legal requests can be sent to [email protected].