Privacy Policy & Data Governance

1. Overview & Commitment to Confidentiality

Btpsec LTD ("BTPSEC", "we", "us", or "our") is a cybersecurity consultancy specializing in penetration testing, cloud security audits, and automated attack surface intelligence. We prioritize the protection of client operational data, vulnerability findings, and corporate intelligence above all else.

This Privacy Policy details how we collect, process, store, and safeguard information when you use our website (btpsec.com), our ExposurAI SaaS platform (exposurai.com), or engage our professional cybersecurity consultancy services.

2. Scope of Data Collection

We strictly limit data collection to technical data necessary for security auditing and business communications:

• Target Domain Reconnaissance Data: Public DNS records, SSL/TLS certificates, IP geolocation data, open service headers, and public OSINT records necessary to perform attack surface scans.
• Client Advisory Submissions: Contact details (Name, Work Email, Corporate Entity) submitted via our secure inquiry forms for advisory proposals.
• Audit Deliverables: Penetration test reports, vulnerability findings, and code playbooks generated for verified clients.

3. Strict Non-Disclosure & Zero Data Monetization

BTPSEC NEVER sells, leases, or monetizes client vulnerability data or contact details under any circumstances. All client engagement records and vulnerability findings are classified as Strictly Confidential.

Vulnerability reports generated during penetration tests or ExposurAI audits are encrypted at rest using AES-256 and stored in zero-trust isolated databases.

4. Data Retention & Erasure Rights (GDPR)

Under UK GDPR and international data protection standards, clients retain full ownership of their assessment data. Upon written request via our advisory portal, BTPSEC will permanently purge target domain audit records and raw scan logs from our servers within 14 business days.