Trust
Security at 210.
A security company should be able to describe its own posture without adjectives. This page lists what we do, what we commit to, and what we have not yet completed.
Practices
What we actually do.
These are controls in operation today. They are described in plain language rather than as a certification claim.
Secure development
Threat modeling at design, peer review on every change, dependency scanning in CI, and signed release artifacts. Our own product is subject to the same cryptographic inventory we sell.
Least privilege by default
Human and machine access is scoped to the task, time-bound where possible, and reviewed on a fixed cadence. Administrative access requires hardware-backed authentication.
Encryption in transit and at rest
Customer data is encrypted with modern AEAD ciphers in transit and at rest, with keys held in managed HSMs and rotation on a defined schedule.
Data minimization
We collect what an engagement requires and define retention before collection. Assessment answers run in your browser and are not transmitted unless you ask for the report.
Vulnerability disclosure
We welcome reports from researchers and follow coordinated disclosure.
Incident response
A documented response plan with defined roles, customer notification commitments, and an annual tabletop exercise. Post-incident reviews are shared with affected customers.
Certifications
Reports available on request.
We will not display a certification, audit report, or customer logo before it exists. Where a report is available, it is shared under NDA.
Current status
No third-party certification is displayed on this page. Our security documentation, architecture summary, and current questionnaire responses are available under NDA. If a certification is required for your procurement, tell us early — we would rather be honest about timing than let it become a surprise.
Subprocessors
We publish a subprocessor list before onboarding customer data, and notify customers of changes. The website as shipped uses no third-party analytics by default.
Commitments
What we will not do.
- We will tell you when a requirement is outside our scope rather than stretch an answer.
- We will not claim a certification, customer, or benchmark we cannot evidence.
- We will document the migration path, not just the recommendation, so your team can own it.
Data handling on this site