How we handle your information.

We use inquiry information to understand what you need, assess whether an engagement is appropriate, assign follow-up responsibility and communicate with you about our services.

Simple inquiry form

Our penetration-testing inquiry page is hosted by HubSpot. It collects your name, email address and a short description of what you need tested, and stores your contact and submission in HubSpot. The form does not subscribe you to marketing emails.

Email and sensitive information

You can also email hello@trespasssec.com; we receive the information you include. Please do not send passwords, API keys, source code, vulnerability evidence, regulated records, production data or other secrets through these inquiry channels.

Website visits

Cloudflare delivers our public website. Cloudflare Web Analytics measures aggregate traffic and page performance on the public website. It does not use cookies or browser storage for analytics, or fingerprint individuals to track them over time. Google Search Console and Bing Webmaster Tools provide search visibility and crawl information.

Our public website and HubSpot inquiry page use HubSpot for page-view measurement and visitor recognition, subject to the cookie choices below. This can connect website activity to an inquiry when you identify yourself by submitting the form. The inquiry page also sends form-load measurements to HubSpot before submission.

Google advertising and retargeting

On pages where we enable Google advertising tags, we use Google Ads to measure advertising and build website-visitor audiences so that our ads can reach previous visitors on Google services and other participating websites. HubSpot manages the Google tag on our public website and HubSpot-hosted inquiry page. This is separate from the submitted-inquiry attribution described above.

These tags may send Google the pages visited, ad interactions, cookie or device identifiers, IP address and browser information. Google and its partners may use cookies or similar technologies to recognize a browser and personalize ads. For US visitors, where permitted, we enable optional analytics and advertising cookies by default to measure visits and advertising, recognize returning visitors and build retargeting audiences. This default does not override an opt-out or a supported Global Privacy Control signal. Where our regional settings require opt-in, optional cookies wait for your choice.

We also use Google's enhanced conversions to improve advertising measurement. Google tags may automatically detect contact details you provide, such as email addresses, phone numbers, names and addresses, and send hashed versions to Google for matching. HubSpot may share selected contact details in hashed form with conversion events, such as a qualified lead or sale. Hashing does not make this information anonymous. We do not send inquiry narratives, uploaded documents or security-testing evidence as advertising event data.

You can use Your Privacy Choices on our public website or HubSpot inquiry page to opt out of optional analytics or advertising cookies and change your choice later. Rejecting advertising cookies does not prevent you from submitting an inquiry. You can also manage personalized Google ads in My Ad Center and learn how Google uses information from sites that use its services. The inquiry-attribution opt-out above controls our separate click-capture feature; it is not a substitute for advertising-cookie choices.

We share inquiry information with the service providers described in this policy as needed to operate our forms, customer-relationship system, communications and measurement, when required by law, or with your direction. Providers process information under their applicable service terms.

We do not sell inquiry information for money or disclose prospective-client information publicly. The advertising activity described above shares visitor information with Google for measurement and personalized advertising. Depending on applicable law, this may be considered sharing for cross-context behavioral advertising or a sale of personal information. We do not upload inquiry text, documents or security-testing evidence to advertising audiences.

Stored inquiries and communications

HubSpot, Google Workspace and Resend records have no automatic time-based expiry. They remain until we manually delete them, a verified deletion request applies, or an engagement, legal or business-record policy controls retention.

Submitted advertising attribution

Our policy limits submitted advertising attribution to 24 months after submission, subject to earlier deletion requests or justified record-retention exceptions. We administer this through manual review; these records do not automatically expire in HubSpot, Microsoft or Google.

When you apply by email, we receive your contact details, resume, work history and other information you provide. We use it to evaluate and communicate with you about your candidacy, conduct interviews, verify information, complete relevant job screening, maintain recruiting records, meet legal obligations and protect our rights.

Google Workspace stores recruiting email and application materials. Authorized personnel and providers supporting recruiting, screening, legal compliance or business operations may receive applicant information only as needed for those purposes.

We may keep unsuccessful applicants' emails and materials for future roles for up to 12 months, unless you opt out, request deletion, or a different legal or employment-record requirement applies.

For questions or requests to access, correct or delete inquiry information where applicable, email hello@trespasssec.com. For a submitted inquiry, we review the associated inquiry and communication records. If you object to further ad attribution, we stop further reporting for the affected inquiry and review related provider records.

To opt out of future-role consideration or request access, correction or deletion of application information where applicable, use our applicant privacy contact at hello@trespasssec.com.

We may need to verify your request before responding.

We may revise this policy as our website or practices change. The version published here is the current one.