Your vulnerability data deserves care.

Client report access

Client reports are restricted to the assigned client and authorized owner through server-side access checks. Connections use HTTPS in hosted Preview and deployment. Passwords are salted and hashed; session and reset tokens are stored as hashes. Do not submit passwords or sensitive vulnerability details through public forms. Additional encryption-at-rest requirements, including AES-256, should be confirmed for your engagement before uploading sensitive reports.

Account protection

Client and owner accounts use separate sign-in flows. Passwords are stored as salted hashes, not plaintext. Access is enforced on the server, with expiring sessions, request protection, and login rate limits. Password reset links are short-lived and single-use when email delivery is configured.

What we collect

Account registration collects your email, username, password hash, and optional phone. Contact and assessment requests store the details you submit so the owner can respond. Do not submit credentials, regulated personal information, or sensitive findings through public forms.

How information is used

Submitted contact information is used to review and respond to your request and support your client account. Client reports are visible only to the assigned client and authorized owner. Hosted infrastructure and operational service providers process data to provide these features.

Cookies and site operation

Essential secure cookies maintain authentication and protect requests. The hosting platform may provide site analytics. This notice is a starting operational description, not a verified compliance certification or a substitute for a final legal privacy policy.

Questions or data requests

For account, correction, or deletion requests, contact justin.hawkins@cjcvmconsulting.com. The owner should finalize retention periods, service-provider details, and engagement-specific encryption controls before handling sensitive production reports.